GHSA-vcgg-hp4r-87gx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vcgg-hp4r-87gx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vcgg-hp4r-87gx/GHSA-vcgg-hp4r-87gx.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vcgg-hp4r-87gx
- Aliases
- Published
- 2022-05-14T01:09:10Z
- Modified
- 2024-04-25T23:43:34Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Contao Does Not Invalidate Existing Sessions When Password Changes
- Details
-
Security researcher Ali Razzaq has discovered that existing sessions are not correctly invalidated when a user changes their password in the backend or frontend.
- Database specific
{ "cwe_ids": [ "CWE-640" ], "github_reviewed": true, "github_reviewed_at": "2024-04-25T23:16:25Z", "nvd_published_at": "2019-04-17T19:29:00Z", "severity": "CRITICAL" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2019-10641
- https://github.com/contao/contao/commit/74c7dfafa0dfa5363a9463b486522d5d526e28fe
- https://github.com/contao/contao/commit/b92e27bc7c9e59226077937f840c74ffd0f672e8
- https://github.com/contao/core/commit/119a1b5bd9e62d27ca2838727084d04f3b7fcd32
- https://contao.org/en/news/security-vulnerability-cve-2019-10641.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10641.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10641.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2019-10641.yaml
Affected packages
Packagist / contao/contao
Package
- Name
- contao/contao
- Purl
- pkg:composer/contao/contao
Packagist / contao/contao
Package
- Name
- contao/contao
- Purl
- pkg:composer/contao/contao
Packagist / contao/core-bundle
Package
- Name
- contao/core-bundle
- Purl
- pkg:composer/contao/core-bundle
Affected versions
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0-beta1
4.1.0-RC1
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0-beta1
4.2.0-RC1
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0-RC1
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.4.0-beta1
4.4.0-RC1
4.4.0-RC2
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
Packagist / contao/core-bundle
Package
- Name
- contao/core-bundle
- Purl
- pkg:composer/contao/core-bundle
Packagist / contao/core
Package
- Name
- contao/core
- Purl
- pkg:composer/contao/core
Affected versions
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.1.beta1
3.1.RC1
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.2.beta1
3.2.beta2
3.2.RC1
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.20
3.2.21
3.3.0-beta1
3.3.0-RC1
3.3.0-RC2
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0-beta1
3.4.0-RC1
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.5.0-beta1
3.5.0-RC1
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.15
3.5.16
3.5.17
3.5.18
3.5.19
3.5.20
3.5.21
3.5.22
3.5.23
3.5.24
3.5.25
3.5.26
3.5.27
3.5.28
3.5.29
3.5.30
3.5.31
3.5.32
3.5.33
3.5.34
3.5.35
3.5.36
3.5.37
3.5.38