PT-2019-11958 · Contao · Contao

Ali Razzaq · Published 2019-04-17 · Updated 2022-05-14 · CVE-2019-10642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao version 4.7

Description The issue allows for a CSRF attack. Security researcher Ali Razzaq has discovered that the request token check can be bypassed.

Recommendations For Contao version 4.7, as a temporary workaround, consider implementing additional CSRF protection measures until a patch is available. Restrict access to sensitive operations to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-10642

GHSA-HWMH-9JJ9-8C9C

Affected Products

Contao

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10642.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10642.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10642 · Security Note
• https://contao.org/en/news.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10642 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hwmh-9jj9-8c9c · Vendor Advisory
• https://contao.org/en/news/security-vulnerability-cve-2019-10642.html · Vendor Advisory
• https://github.com/contao/contao · Note
• https://github.com/contao/contao/commit/ee2c8130c2e68a1d0d2e75bd6b774c4393942b15 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10642 · Note