CVE-2024-30262 - Vulnerability Details - OpenCVE

Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Contao	Contao

Configuration 1 [-]

cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9
https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5

History

Thu, 09 Jan 2025 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Contao Contao contao
CPEs		cpe:2.3:a:contao:contao::::::::
Vendors & Products		Contao Contao contao

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-04-09T16:45:57.132Z

Updated: 2024-08-02T01:32:07.058Z

Reserved: 2024-03-26T12:52:00.935Z

Link: CVE-2024-30262

Vulnrichment

Updated: 2024-08-02T01:32:07.058Z

NVD

Status : Analyzed

Published: 2024-04-09T17:16:02.850

Modified: 2025-01-09T17:51:27.337

Link: CVE-2024-30262

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-30262", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-26T12:52:00.935Z", "datePublished": "2024-04-09T16:45:57.132Z", "dateUpdated": "2024-08-02T01:32:07.058Z"}, "containers": {"cna": {"title": "Contao's remember-me tokens will not be cleared after a password change", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-384", "lang": "en", "description": "CWE-384: Session Fixation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}, {"name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}], "affected": [{"vendor": "contao", "product": "contao", "versions": [{"version": "< 4.13.40", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-09T16:45:57.132Z"}, "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"}], "source": {"advisory": "GHSA-r4r6-j2j3-7pp5", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30262", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:19:06.729095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:39:15.815Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:07.058Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}, {"name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:07.058Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30262", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:19:06.729095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:22.947Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Contao's remember-me tokens will not be cleared after a password change", "source": {"advisory": "GHSA-r4r6-j2j3-7pp5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "contao", "product": "contao", "versions": [{"status": "affected", "version": "< 4.13.40"}]}], "references": [{"url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384: Session Fixation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-09T16:45:57.132Z"}}}, "cveMetadata": {"cveId": "CVE-2024-30262", "state": "PUBLISHED", "dateUpdated": "2024-08-02T01:32:07.058Z", "dateReserved": "2024-03-26T12:52:00.935Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-09T16:45:57.132Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "matchCriteriaId": "481B6B86-03CA-4612-99A8-18381D0E16F2", "versionEndExcluding": "4.13.40", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"}, {"lang": "es", "value": "Contao es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto. Antes de la versi\u00f3n 4.13.40, cuando un miembro del frontend cambia su contrase\u00f1a en los datos personales o en el m\u00f3dulo de contrase\u00f1a perdida, los tokens de recordarme correspondientes no se eliminan. Si alguien compromete una cuenta y puede obtener un token de recuerdo, cambiar la contrase\u00f1a no ser\u00eda suficiente para recuperar el control de la cuenta. La versi\u00f3n 4.13.40 contiene una soluci\u00f3n para el problema. Como workaround, deshabilite \"Permitir inicio de sesi\u00f3n autom\u00e1tico\" en el m\u00f3dulo de inicio de sesi\u00f3n."}], "id": "CVE-2024-30262", "lastModified": "2025-01-09T17:51:27.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-09T17:16:02.850", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}, {"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}]}