GHSA-hwmh-9jj9-8c9c
Contao CSRF Token Bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | contao/contao | >= 4.7.0, < 4.7.3 | 4.7.3 |
| Packagist | contao/core-bundle | >= 4.7.0, < 4.7.3 | 4.7.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Security researcher Ali Razzaq has discovered that the request token check can be bypassed in Contao 4.7
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-10642
- https://github.com/contao/contao/commit/ee2c8130c2e68a1d0d2e75bd6b774c4393942b15
- https://contao.org/en/news.html
- https://contao.org/en/news/security-vulnerability-cve-2019-10642.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10642.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10642.yaml
- https://github.com/contao/contao