CVE-2024-30262CWE-384CWE-613

Contao's remember-me tokens will not be cleared after a password change

Medium · published April 9, 2024

CVSS v3.1
5.9
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.9th percentile
Weaknesses
CWE-384 · Session Fixation; CWE-613 · Insufficient Session Expiration
Published
2024-04-09T16:45Z
EPSS history
Timeline
  • 09 APR 16:45Z
    Contao's remember-me tokens will not be cleared after a password change
    cvelistv5