CVE-2019-10643 — Improper Authentication in Contao

CWE-287 — Improper AuthenticationCWE-324 — Use of a Key Past its Expiration Date4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.4%
top 37.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
ContaoContao Core-bundleContao CMS
Timeline
PublishedApr 17
Latest updateMay 13

Description

Contao 4.7 allows Use of a Key Past its Expiration Date.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Packagistcontao/contao4.7.0 — 4.7.3
▶Packagistcontao/core-bundle4.7.0 — 4.7.3

🔴Vulnerability Details

3
GHSA
Contao Does Not Expire Tokens Correctly↗2022-05-13
▶
OSV
Contao Does Not Expire Tokens Correctly↗2022-05-13
▶
CVEList
CVE-2019-10643: Contao 4↗2019-04-17
▶
CVE-2019-10643 — Improper Authentication in Contao | cvebase