--- title: "TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2015-001" description: It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Product Updates & Roadmap" - TYPO3 CMS --- # TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5 - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5 ============================================================== 19 February 2015 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 CMS 4.5.x is vulnerable to Authentication Bypass. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7569d41262328e5ed8d27b53e03970ec.png)[Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) **Component Type:** TYPO3 CMS **Vulnerability Types:** Authentication Bypass **Overall Severity:** High **Release Date:** February 19, 2015 **Vulnerable subcomponent:** RSA Authentication (ext:rsaauth) **Vulnerability Type:** Authentication Bypass **Affected Versions:** Versions 4.3.0 to 4.3.14, 4.4.0 to 4.4.15, 4.5.0 to 4.5.39 and 4.6.0 to 4.6.18 **Severity:** High **Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:C/I:P/A:N/E:F/RL:OF/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:M/Au:N/C:C/I:P/A:N/E:F/RL:OF/RC:C)) **CVE:** [CVE-2015-2047](https://nvd.nist.gov/vuln/detail/CVE-2015-2047) **Problem Description:** It has been discovered that TYPO3 CMS is vulnerable to Authentication Bypass. Frontend users can be authenticated by only knowing their username. TYPO3 installations are **affected,** if **all** of the following applies: - TYPO3 Version 4.3.0 to 4.3.14, 4.4.0 to 4.4.15, 4.5.0 to 4.5.39 or 4.6.0 to 4.6.18 - users/access restricted frontend area (frontend login) - system extension *rsaauth* is **loaded** - system extension *rsaauth* is **configured** for frontend usage like that: ``` $GLOBALS['TYPO3_CONF_VARS']['FE']['loginSecurityLevel'] = 'rsa' ``` TYPO3 installations are **not affected,** if **at least one** of the following applies: - TYPO3 Version 4.7.0 or higher - **no** users/access restricted frontend area (TYPO3 Backend authentication is not affected) - system extension *rsaauth* is **not loaded** (default) - system extension *rsaauth* is **not configured** for frontend usage like that (default): ``` $GLOBALS['TYPO3_CONF_VARS']['FE']['loginSecurityLevel'] = 'rsa' ``` **Solution:** Update to TYPO3 version 4.5.40 that fixes the problem described. Alternatively use the provided shell script to patch all affected TYPO3 versions (all between 4.3 and 4.6) that are found in a specified directory or use the [diff file](https://git.typo3.org/Packages/TYPO3.CMS.git/commitdiff_plain/3fbd91c58baf98bdd8988333d90294cc6dc8f0c7) to patch the installations manually. **Important Note:** Updating or patching your installations to fix this **CRITICAL** vulnerability is **STRONGLY ADVISED!** **Credits:** Thanks to Pierrick Caillon who discovered and reported the vulnerability and to Security Team Member Nicole Cordes for developing a fix and providing the shell script. **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Opens external link in new window"). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. **General Note:** All security related code changes are tagged so that you can easily look them up on our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). --- **Document Updates** - 2015-02-23 by Helmut Hummel: referenced CVE - 2020-10-08 by Oliver Hader: adjusted CVSS v2.0, adjusted severity from "critical" to "high" ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bb9efc51bced8582e7b8c235f4b5f2b5.png) About the Author [Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) [More posts by this author](https://news.typo3.com/article/author/helmut-hummel)