GHSA-c5mj-39cf-3pp5: 
PHP vulnerability analysis and mitigation

A security misconfiguration vulnerability was discovered in TYPO3 CMS (CVE: GHSA-c5mj-39cf-3pp5) affecting backend user account management. The vulnerability affects TYPO3 versions 8.0.0-8.7.22 and 9.0.0-9.5.3, and was disclosed on January 22, 2019. The issue allows the creation of backend user accounts with insecure or empty credentials when using the TYPO3 backend interface (TYPO3 Advisory).

When the type of user account is changed (entity type or admin flag) in the backend form, the system reloads to reflect configuration changes. This process could lead to persisting the current state with empty or weak credentials. The vulnerability has been assigned a High severity rating with a CVSS score of 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). While the TYPO3 core functionality cannot directly use empty usernames or passwords, this poses a significant risk for custom authentication service implementations (GitHub Advisory).

The vulnerability could result in accounts containing empty login credentials (username and/or password) or incomplete accounts with weak credentials. While this cannot be directly exploited and requires interaction from a backend user with appropriate privileges, it presents a severe security risk particularly for systems using custom authentication service implementations (TYPO3 Advisory).

The vulnerability requires interaction from a backend user with appropriate privileges to be exploited. It cannot be directly exploited without such interaction. The attack complexity is considered Low, requiring network access and low privileges, but user interaction is required for exploitation (GitHub Advisory).

The vulnerability was patched in TYPO3 versions 8.7.23 and 9.5.4. The fix includes disabling new backend user accounts by default, requiring manual activation, and implementing automatic random value generation for empty usernames and passwords. Organizations can modify this behavior by adjusting the TCA configuration and hook settings. The patch ensures that no empty values for username and password are persisted (TYPO3 Advisory).