CVE-2019-10643: Contao Does Not Expire Tokens Correctly
Summary
CVE-2019-10643: Contao Does Not Expire Tokens Correctly. Affects contao/contao versions >= 4.7.0, < 4.7.3. Fixed in 4.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Contao is a popular open-source content management system (CMS) that allows users to create and manage websites. It provides a wide range of features, including user authentication and opt-in functionality. Contao versions 4.7.0 to 4.7.3 are affected by a vulnerability that allows opt-in tokens to remain valid even after a new token has been confirmed. This can lead to unauthorized access and potential security breaches.
Vulnerability Detail
The vulnerability in Contao arises from the incorrect handling of opt-in tokens. When a user confirms a new opt-in token, the system fails to invalidate any previously issued tokens. As a result, an attacker who possesses an old token can still use it to gain access to the system, even after a new token has been confirmed. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
4.7.3
This is the first release that contains the fix.
composer require contao/contao:4.7.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Contao to the fixed version to address the issue effectively.
Conclusion
The vulnerability in Contao that allows opt-in tokens to remain valid after a new token has been confirmed can lead to unauthorized access and potential security breaches. It is crucial for users to update their Contao installations to version 4.7.3 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/contao →
FAQ
This vulnerability allows attackers to use old opt-in tokens to gain unauthorized access to the system, potentially leading to data breaches and compromise of the entire system.
Contao versions 4.7.0 to 4.7.3 are affected by this vulnerability.
Yes, the Contao development team has fixed this vulnerability in version 4.7.3.
No, there are no known workarounds. Updating Contao to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/contao.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
