CVE-2019-10641: Contao Does Not Invalidate Existing Sessions When Password Changes
Summary
CVE-2019-10641: Contao Does Not Invalidate Existing Sessions When Password Changes. Affects contao/contao across 2 version ranges.
>= 4.0.0, < 4.4.37
>= 4.5.0, < 4.7.3
Fixed in 4.4.37 or 4.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as user authentication, backend and frontend editing, and session management. However, a vulnerability has been discovered in Contao where existing sessions are not correctly invalidated when a user changes their password in the backend or frontend. This can lead to unauthorized access and potential compromise of user accounts.
Vulnerability Detail
The vulnerability in Contao arises from the failure to invalidate existing sessions when a user changes their password. This means that even after changing their password, an attacker with access to a valid session can continue to access the system using the old session. This can result in unauthorized actions being performed on behalf of the user, such as modifying content, accessing sensitive information, or impersonating the user. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.4.374.4.37composer require contao/contao:4.4.37 -
>= 4.5.0, < 4.7.34.7.3composer require contao/contao:4.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions of Contao to mitigate the risk.
Conclusion
The vulnerability in Contao that allows existing sessions to remain valid after a password change poses a significant security risk. It is crucial for users of Contao to update to the fixed versions and follow the recommended upgrade instructions to ensure the security of their installations. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/contao →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your Contao installation is affected by this vulnerability. Simply upload your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, this vulnerability requires an attacker to have access to a valid session in order to exploit it. However, if an attacker gains access to a valid session, they can continue to exploit the vulnerability remotely.
No, only versions 4.0.0 to 4.4.37 and 4.5.0 to 4.7.3 of Contao are affected by this vulnerability. It is recommended to update to the fixed versions to ensure the security of your installation.
The consequences of this vulnerability include unauthorized access to user accounts, potential data breaches, and unauthorized actions performed on behalf of users. It is crucial to address this vulnerability promptly to protect user data and maintain the integrity of the system.
There is no known evidence of this vulnerability being exploited in the wild. However, it is always recommended to apply security patches and updates as soon as they are available to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/contao.
