Vulnerability · Published Apr 9, 2024 · Assigned by GitHub_M
CVE-2024-30262Contao's remember-me tokens will not be cleared after a password change
Medium 5.9
In plain English
A medium-severity session fixation in contao from contao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | contao/core-bundle | 4.13.40 | GHSA-r4r6-j2j3-7pp5 |
Affected products (as reported)
Weakness: CWE-613, CWE-384 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N