{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-30262", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-26T12:52:00.935Z", "datePublished": "2024-04-09T16:45:57.132Z", "dateUpdated": "2024-08-02T01:32:07.058Z"}, "containers": {"cna": {"title": "Contao's remember-me tokens will not be cleared after a password change", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-384", "lang": "en", "description": "CWE-384: Session Fixation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}, {"name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}], "affected": [{"vendor": "contao", "product": "contao", "versions": [{"version": "< 4.13.40", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-09T16:45:57.132Z"}, "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"}], "source": {"advisory": "GHSA-r4r6-j2j3-7pp5", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30262", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:19:06.729095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:39:15.815Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:07.058Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}, {"name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:07.058Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30262", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:19:06.729095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:22.947Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Contao's remember-me tokens will not be cleared after a password change", "source": {"advisory": "GHSA-r4r6-j2j3-7pp5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "contao", "product": "contao", "versions": [{"status": "affected", "version": "< 4.13.40"}]}], "references": [{"url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384: Session Fixation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-09T16:45:57.132Z"}}}, "cveMetadata": {"cveId": "CVE-2024-30262", "state": "PUBLISHED", "dateUpdated": "2024-08-02T01:32:07.058Z", "dateReserved": "2024-03-26T12:52:00.935Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-09T16:45:57.132Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "matchCriteriaId": "481B6B86-03CA-4612-99A8-18381D0E16F2", "versionEndExcluding": "4.13.40", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"}, {"lang": "es", "value": "Contao es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto. Antes de la versi\u00f3n 4.13.40, cuando un miembro del frontend cambia su contrase\u00f1a en los datos personales o en el m\u00f3dulo de contrase\u00f1a perdida, los tokens de recordarme correspondientes no se eliminan. Si alguien compromete una cuenta y puede obtener un token de recuerdo, cambiar la contrase\u00f1a no ser\u00eda suficiente para recuperar el control de la cuenta. La versi\u00f3n 4.13.40 contiene una soluci\u00f3n para el problema. Como workaround, deshabilite \"Permitir inicio de sesi\u00f3n autom\u00e1tico\" en el m\u00f3dulo de inicio de sesi\u00f3n."}], "id": "CVE-2024-30262", "lastModified": "2025-01-09T17:51:27.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-09T17:16:02.850", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}, {"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}