Description
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2013-2447 Vulnerability (CVE-2013-2447)
MongoDb Out-of-bounds Write Vulnerability (CVE-2021-32040)
Telerik Web UI Insufficiently Protected Credentials Vulnerability (CVE-2017-9248)
WordPress Plugin YITH WooCommerce Request A Quote Security Bypass (1.4.7)
MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2010-1648)