PT-2019-11958 · Contao · Contao

Ali Razzaq · Publicado 2019-04-17 · Atualizado 2022-05-14 · CVE-2019-10642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao version 4.7

Description The issue allows for a CSRF attack. Security researcher Ali Razzaq has discovered that the request token check can be bypassed.

Recommendations For Contao version 4.7, as a temporary workaround, consider implementing additional CSRF protection measures until a patch is available. Restrict access to sensitive operations to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-10642

GHSA-HWMH-9JJ9-8C9C

Produtos afetados

Contao

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10642.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10642.yaml · Exploit
• https://github.com/contao/contao · Nota
• https://github.com/contao/contao/commit/ee2c8130c2e68a1d0d2e75bd6b774c4393942b15 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10642 · Nota de Segurança
• https://contao.org/en/news.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10642 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hwmh-9jj9-8c9c · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10642 · Nota
• https://contao.org/en/news/security-vulnerability-cve-2019-10642.html · Aviso do Fabricante