CVE-2024-30262

{"id": "CVE-2024-30262", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2024-04-09T17:16:02.850", "references": [{"url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-384"}, {"lang": "en", "value": "CWE-613"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"}, {"lang": "es", "value": "Contao es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto. Antes de la versi\u00f3n 4.13.40, cuando un miembro del frontend cambia su contrase\u00f1a en los datos personales o en el m\u00f3dulo de contrase\u00f1a perdida, los tokens de recordarme correspondientes no se eliminan. Si alguien compromete una cuenta y puede obtener un token de recuerdo, cambiar la contrase\u00f1a no ser\u00eda suficiente para recuperar el control de la cuenta. La versi\u00f3n 4.13.40 contiene una soluci\u00f3n para el problema. Como workaround, deshabilite \"Permitir inicio de sesi\u00f3n autom\u00e1tico\" en el m\u00f3dulo de inicio de sesi\u00f3n."}], "lastModified": "2025-01-09T17:51:27.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "481B6B86-03CA-4612-99A8-18381D0E16F2", "versionEndExcluding": "4.13.40"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}