CVE-2019-10642: CSRF
First published: Tue Apr 09 2019(Updated: )
Contao 4.7 allows CSRF.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/contao/contao | >=4.7.0<4.7.3 | |
| composer/contao/core-bundle | >=4.7.0<4.7.3 | |
| Contao Contao Cms | =4.7.0 | |
| composer/contao/core-bundle | >=4.7.0<4.7.3 | 4.7.3 |
| composer/contao/contao | >=4.7.0<4.7.3 | 4.7.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://contao.org/en/news/security-vulnerability-cve-2019-10642.html
- https://contao.org/en/news.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-10642
- https://github.com/contao/contao/commit/ee2c8130c2e68a1d0d2e75bd6b774c4393942b15
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10642.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10642.yaml
- https://github.com/advisories/GHSA-hwmh-9jj9-8c9c (Advisory)
Frequently Asked Questions
What is CVE-2019-10642?
CVE-2019-10642 is a vulnerability in Contao 4.7 that allows CSRF attacks.
How severe is CVE-2019-10642?
CVE-2019-10642 has a severity rating of 8.8 (high).
How can the CSRF token check be bypassed in Contao 4.7?
The CSRF token check in Contao 4.7 can be bypassed, enabling attackers to perform CSRF attacks.
Which versions of Contao and core-bundle are affected by CVE-2019-10642?
Contao versions 4.7.0 up to, but not including, 4.7.3 are affected by CVE-2019-10642. The same applies to core-bundle versions in the same range.
Is Contao CMS version 4.7.0 affected by CVE-2019-10642?
Yes, Contao CMS version 4.7.0 is affected by CVE-2019-10642.
Where can I find more information about CVE-2019-10642?
More information about CVE-2019-10642 can be found at the following links: [1](https://contao.org/en/news/security-vulnerability-cve-2019-10642.html), [2](https://contao.org/en/news.html).
What is the CWE classification of CVE-2019-10642?
CVE-2019-10642 is classified as CWE-352 (Cross-Site Request Forgery).
- collector/friends-of-php
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-hwmh-9jj9-8c9c
- alias/CVE-2019-10642
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/event
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- agent/tags
- collector/github-advisory
- package-manager/composer
- vendor/contao
- canonical/contao contao cms
- version/contao contao cms/4.7.0