Description

Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.

INFO

Published Date :

2024-04-09T16:45:57.132Z

Last Modified :

2024-08-02T01:32:07.058Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-30262 vulnerability.

Vendors Products
Contao
  • Contao
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-30262.

URL Resource
https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9 cve-icon cve-icon cve-icon
https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact