The vulnerability arises in the backend user settings module of TYPO3 CMS, where changing a user password results in the cleartext password being written to the uc and user_settings columns of the be_users database table. This insecure storage of sensitive data (CWE-312) means that any party with database access can read stored passwords, potentially compromising user accounts and enabling further unauthorized actions. The CVSS score of 7.3 reflects a moderate-to-high risk of credential compromise in environments that rely on CMS backend authentication.

TYPO3 CMS version 14.2.0 is affected. No other versions were listed as impacted, so only installations of the 14.2.0 release are known to be vulnerable.

The EPSS score indicates a probability of exploitation of less than 1%. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known active exploitation. Because the issue is triggered by altering passwords through the backend user interface, a likely attack vector involves an insider or an attacker who has already gained database access; there is no direct external network exploitation mentioned, so the risk is largely limited to systems with insufficient isolation of the CMS backend and database.