CVE-2019-10642

Contao 4.7 allows CSRF...

Default credentials

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...

CVE-2018-20028

Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...

CVE-2018-20028

Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...

CVE-2018-20028

The CVE-2018-20028 vulnerability affects Contao: 3.x before 3.5.37, 4.4.x before 4.4.31, and 4.6.x before 4.6.11 suffer from Incorrect Access Control that enables viewing records not authorized for the logged-in back end user. The issue allows unauthorized users to view records (e.g., pages, arti...

CVE-2019-10642

Contao 4.7 allows CSRF...

CVE-2019-10642

Contao 4.7 is affected by a CSRF token check bypass (CSRF vulnerability). Multiple connected advisories (GHSA-HWMH-9JJ9-8C9C, OSV/GHSA-...) describe that the request token verification can be bypassed, enabling unauthorized actions within Contao 4.7. The CVE entry CVE-2019-10642 explicitly states...

CVE-2019-10643

CVE-2019-10643 affects Contao 4.7 where an opt-in token can be misused because old opt-in tokens are not invalidated when a new token is confirmed. The root cause is token lifecycle not expiring prior tokens; this is described across multiple connected advisories (GHSA-j99G-QJVX-995G, Contao secu...

CVE-2019-10643

Contao 4.7 allows Use of a Key Past its Expiration Date...

CVE-2019-10643

Contao 4.7 allows Use of a Key Past its Expiration Date...

CVE-2019-10641

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...

CVE-2019-10641

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...

CVE-2019-10641

Contao contains a session invalidation flaw: existing user sessions are not properly invalidated when a password is changed. Affected versions include Contao 3.* up to 3.5.38 and Contao 4.x up to 4.7.2, with the fix released in Contao 3.5.39, 4.4.37, or 4.7.3. The issue, identified in CVE-2019-10...

CVE-2019-10643: Improper Authentication

Contao 4.7 allows Use of a Key Past its Expiration Date...

CVE-2019-10641: Weak Password Recovery Mechanism for Forgotten Password

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...

PT-2019-11958

Name of the Vulnerable Software and Affected Versions Contao version 4.7 Description The issue allows for a CSRF attack. Security researcher Ali Razzaq has discovered that the request token check can be bypassed. Recommendations For Contao version 4.7, as a temporary workaround, consider...

PT-2019-9971

Name of the Vulnerable Software and Affected Versions Contao versions 3.x through 3.5.36 Contao versions 4.4.x through 4.4.30 Contao versions 4.6.x through 4.6.10 Description The issue is related to Incorrect Access Control, which can potentially allow unauthorized access to certain resources or...

PT-2019-11957

Name of the Vulnerable Software and Affected Versions Contao versions prior to 3.5.39 Contao versions 4.x prior to 4.7.3 Description The issue is related to a weak password recovery mechanism for forgotten passwords. Additionally, when a user changes their password, existing sessions are not...

CVE-2018-20028: Undefined Security Weakness

Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...

PT-2019-11959

Name of the Vulnerable Software and Affected Versions Contao version 4.7 Description The issue allows the use of a key past its expiration date. A security researcher discovered that confirming an opt-in token does not invalidate previous opt-in tokens. Recommendations For Contao version 4.7,...