CVE-2019-10642: CSRF
Contao 4.7 allows CSRF.
Other sources
Security researcher Ali Razzaq has discovered that the request token check can be bypassed in Contao 4.7
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10642?
CVE-2019-10642 is a vulnerability in Contao 4.7 that allows CSRF attacks.
How severe is CVE-2019-10642?
CVE-2019-10642 has a severity rating of 8.8 (high).
How can the CSRF token check be bypassed in Contao 4.7?
The CSRF token check in Contao 4.7 can be bypassed, enabling attackers to perform CSRF attacks.
Which versions of Contao and core-bundle are affected by CVE-2019-10642?
Contao versions 4.7.0 up to, but not including, 4.7.3 are affected by CVE-2019-10642. The same applies to core-bundle versions in the same range.
Is Contao CMS version 4.7.0 affected by CVE-2019-10642?
Yes, Contao CMS version 4.7.0 is affected by CVE-2019-10642.
Where can I find more information about CVE-2019-10642?
More information about CVE-2019-10642 can be found at the following links: [1](https://contao.org/en/news/security-vulnerability-cve-2019-10642.html), [2](https://contao.org/en/news.html).
What is the CWE classification of CVE-2019-10642?
CVE-2019-10642 is classified as CWE-352 (Cross-Site Request Forgery).