- Security-news - lists.drupal.org

SA-CONTRIB-2012-083 - Taxonomy List - Cross Site Scripting (XSS)
by security-news＠drupal.org 23 May '12

23 May '12

View online: http://drupal.org/node/1597262 * Advisory ID: DRUPAL-SA-CONTRIB-2012-083 * Project: Taxonomy List [1] (third-party module) * Version: 6.x * Date: 2012-May-23 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- CVE: Requested This module enables you to display the terms (and optionally nodes) under categories. The module doesn't sufficiently sanitize user supplied text in the taxonomy information. This vulnerability is mitigated by the fact that an attacker must have a role with permissions to create or edit taxonomy terms. -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonomy List 6.x-1.x versions prior to 6.x-1.4. The 6.x-2.x branch is not affected. Drupal core is not affected. If you do not use the contributed Taxonomy List [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Taxonomy List module for Drupal 6.x, upgrade to Taxonomy List 6.x-2.0 [4]. * If you must use the 6.x-1.x branch of the Taxonomy List module for Drupal 6.x, upgrade to Taxonomy List 6.x-1.4 [5] (which is no longer supported). Also see the Taxonomy List [6] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Wilder-Tack [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Nancy Wichmann [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Lee Rowlands [9] * Forest Monsen [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/taxonomy_list [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/taxonomy_list [4] http://drupal.org/node/815066 [5] http://drupal.org/node/1595396 [6] http://drupal.org/project/taxonomy_list [7] http://drupal.org/user/96647 [8] http://drupal.org/user/101412 [9] http://drupal.org/user/395439 [10] http://drupal.org/user/181798 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-082 - Zen - Cross Site Scripting
by security-news＠drupal.org 16 May '12

16 May '12

View online: http://drupal.org/node/1585960 * Advisory ID: DRUPAL-SA-CONTRIB-2012-082 * Project: Zen [1] (third-party theme) * Version: 6.x * Date: 2012-May-16 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- CVE: Requested. The Zen theme provides a configurable breadcrumb which is commonly used as an additional navigation tool for users. The theme outputs the breadcrumb, but does not provide sufficient filtering to prevent a Cross site scripting (XSS) attack. This vulnerability is mitigated by the fact that the "Append the content title to the end of the breadcrumb" checkbox is not enabled by default and needs to be enabled for this to be exploited. -------- VERSIONS AFFECTED --------------------------------------------------- * Zen 6.x-1.x versions prior to 6.x-1.1 Drupal core is not affected. Zen versions 6.x-2.x are not affected. If you do not use the contributed Zen [3] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Zen theme for Drupal 6.x, upgrade to theme 6.x-1.1 [4] or any later version. If you copied code from the zen_breadcrumb function into a custom sub-theme's template.php file you should compare your code to the changes to ensure that menu_get_active_title() is properly wrapped in check plain like: check_plain(menu_get_active_title()); Also see the Zen [5] project page. -------- REPORTED BY --------------------------------------------------------- * Jakub Suchy [6] of the Drupal Security Team * Premek Sumpela [7] -------- FIXED BY ------------------------------------------------------------ * Jakub Suchy [8] of the Drupal Security Team * John Albin Wilkins [9] the theme maintainer -------- COORDINATED BY ------------------------------------------------------ * Dave Reid [10] of the Drupal Security Team * Peter Wolanin [11] of the Drupal Security Team * Greg Knaddison [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] http://drupal.org/project/zen [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/zen [4] http://drupal.org/node/628480 [5] http://drupal.org/project/zen [6] http://drupal.org/user/31977 [7] http://drupal.org/user/31391 [8] http://drupal.org/user/31977 [9] http://drupal.org/user/32095 [10] http://drupal.org/user/53892 [11] http://drupal.org/user/49851 [12] http://drupal.org/user/36762 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-081 - Aberdeen - Cross Site Scripting
by security-news＠drupal.org 16 May '12

16 May '12

View online: http://drupal.org/node/1585890 * Advisory ID: DRUPAL-SA-CONTRIB-2012-081 * Project: Aberdeen [1] (third-party theme) * Version: 6.x * Date: 2012-May-16 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- CVE: Requested. The Aberdeen theme provides a configurable breadcrumb which is commonly used as an additional navigation tool for users. The theme outputs the breadcrumb, but does not provide sufficient filtering to prevent a Cross site scripting (XSS) attack. This vulnerability is mitigated by the fact that the "Append the content title to the end of the breadcrumb" checkbox is not enabled by default and needs to be enabled for this to be exploited. -------- VERSIONS AFFECTED --------------------------------------------------- * Aberdeen 6.x-1.x versions prior to 6.x-1.11 Drupal core is not affected. If you do not use the contributed Aberdeen [3] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Aberdeen theme for Drupal 6.x, upgrade to theme 6.x-1.11 [4] If you copied code from the aberdeen_breadcrumb function into a custom sub-theme's template.php file you should compare your code to the changes to ensure that menu_get_active_title() is properly wrapped in check plain like: check_plain(menu_get_active_title()); Also see the Aberdeen [5] project page. -------- REPORTED BY --------------------------------------------------------- * Jakub Suchy [6] of the Drupal Security Team * Premek Sumpela [7] -------- FIXED BY ------------------------------------------------------------ * Jakub Suchy [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team * Ishmael Sanchez [10] the theme maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team * Michael Hess [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] http://drupal.org/project/aberdeen [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/aberdeen [4] http://drupal.org/node/1585878 [5] http://drupal.org/project/aberdeen [6] http://drupal.org/user/31977 [7] http://drupal.org/user/31391 [8] http://drupal.org/user/31977 [9] http://drupal.org/user/102818 [10] http://drupal.org/user/464624 [11] http://drupal.org/user/36762 [12] http://drupal.org/user/102818 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-080 - Hostmaster (Aegir) - Access Bypass and Cross Site Scripting (XSS)
by security-news＠drupal.org 16 May '12

16 May '12

View online: http://drupal.org/node/1585678 * Advisory ID: DRUPAL-SA-CONTRIB-2012-080 * Project: Hostmaster (Aegir) [1] (third-party module) * Version: 6.x * Date: 2012-May-16 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- .... Cross Site Scripting CVE: Requested. Hostmaster displays a log from tasks executed in Aegir's backend component, provision. In certain circumstances these log messages were not escaped properly before being displayed to the user. This vulnerability is mitigated by the fact that people wishing to exploit this must have access to the PHP code of either provision itself or one of the sites hosted by Aegir. .... Access Bypass CVE: Requested. Hostmaster doesn't allow people to edit or create certain node types that are used for the internal representation of data. The implementation of this wasn't fully complete and would still allow privileged users to edit these nodes. This can cause some data corruption in the front-end, leading to tasks that would appear to never finish running. This vulnerability is mitigated by the fact that people wishing to exploit this must have the 'edit package' or 'administer nodes' permissions, which are not given to any roles by the default Aegir install. -------- VERSIONS AFFECTED --------------------------------------------------- * Hostmaster 6.x-1.x versions prior to 6.x-1.9. Drupal core is not affected. If you do not use the contributed Hostmaster (Aegir) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Follow the upgrade instructions in the release notes for the Aegir 1.9 release which can be found at: http://community.aegirproject.org/1.9 [4] Also see the Hostmaster (Aegir) [5] project page. -------- REPORTED BY --------------------------------------------------------- * The Cross Site Scripting vulnerability was reported by Steven Jones [6] one of the module maintainers. * The Access Bypass vulnerability was reported by Ivo Van Geertruyen [7] of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * The Cross Site Scripting vulnerability was fixed by Steven Jones [8] one of the module maintainers. * The Access Bypass vulnerability was fixed by Ivo Van Geertruyen [9] of the Drupal Security Team and mig5 [10] one of the module maintainers. -------- COORDINATED BY ------------------------------------------------------ * Ivo Van Geertruyen [11] of the Drupal Security Team. * Greg Knaddison [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] http://drupal.org/project/hostmaster [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/hostmaster [4] http://community.aegirproject.org/1.9 [5] http://drupal.org/project/hostmaster [6] http://drupal.org/user/99644 [7] http://drupal.org/user/383424 [8] http://drupal.org/user/99644 [9] http://drupal.org/user/383424 [10] http://drupal.org/user/153206 [11] http://drupal.org/user/383424 [12] http://drupal.org/user/36762 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-079 - Post Affiliate Pro - Cross Site Scripting (XSS) and Access Bypass - Unsupported
by security-news＠drupal.org 16 May '12

16 May '12

View online: http://drupal.org/node/1585648 * Advisory ID: DRUPAL-SA-CONTRIB-2012-079 * Project: Post Affiliate Pro [1] (third-party module) * Version: 6.x * Date: 2012-May-16 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Access bypass -------- DESCRIPTION --------------------------------------------------------- CVE: Requested. Post Affiliate Pro (PAP) is a module providing affiliate functionality for Ubercart and Post Affiliate Pro application. The module doesn't sufficiently filter user supplied text provided by users registering on the site and also allows unauthorized users to view other user's commission. -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of the module. Drupal core is not affected. If you do not use the contributed Post Affiliate Pro [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ The module is no longer supported. Users should disable it. Users interested in continuing to use it should see the project page for more information. Also see the Post Affiliate Pro [4] project page. -------- REPORTED BY --------------------------------------------------------- * Lee Rowlands [5] -------- FIXED BY ------------------------------------------------------------ No fix was provided. -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/uc_post_affiliate_pro [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/uc_post_affiliate_pro [4] http://drupal.org/project/uc_post_affiliate_pro [5] http://drupal.org/user/395439 [6] http://drupal.org/user/102818 [7] http://drupal.org/user/36762 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-078 - Smart Breadcrumb - Cross Site Scripting (XSS)
by security-news＠drupal.org 16 May '12

16 May '12

View online: http://drupal.org/node/1585564 * Advisory ID: DRUPAL-SA-CONTRIB-2012-078 * Project: Smart Breadcrumb [1] (third-party module) * Version: 6.x * Date: 2012-May-16 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- CVE: Requested. The function filter_titles() incorrectly attempts to set a title to plain-text, but does not properly filter user supplied text. This vulnerability is mitigated by the fact that an attacker must have the permission to create or edit a node to exploit the issue. -------- VERSIONS AFFECTED --------------------------------------------------- * Smart Breadcrumb 6.x-2.x versions prior to 6.x-1.3. Drupal core is not affected. If you do not use the contributed Smart Breadcrumb [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Smart Breadcrumb module for Drupal 6.x, upgrade to Smart Breadcrumb 6.x-1.3 [4] Also see the Smart Breadcrumb [5] project page. -------- REPORTED BY --------------------------------------------------------- * coltrane [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * divThis [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team * Mori Sugimoto [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/smart_breadcrumb [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/smart_breadcrumb [4] http://drupal.org/node/1568216 [5] http://drupal.org/project/smart_breadcrumb [6] http://drupal.org/user/60 [7] http://drupal.org/user/489334 [8] http://drupal.org/user/102818 [9] http://drupal.org/user/82971 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-77 - Advertisement - Cross Site Scripting & Information Disclosure
by security-news＠drupal.org 16 May '12

16 May '12

View online: http://drupal.org/node/1585544 * Advisory ID: DRUPAL-SA-CONTRIB-2012-077 * Project: Advertisement [1] (third-party module) * Version: 6.x * Date: 2012-May-16 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Information Disclosure, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- CVE: Requested. This module enables you to serve advertisements, define pools of ads and show certain ads on certain pages. The module could, under certain conditions, expose limited site configuration information and a debugging mode did not sufficiently sanitize input, allowing for potential cross-site scripting (XSS). This vulnerability is mitigated by the fact that exposed data must have been explicitly set in the $conf variable in settings.php. -------- VERSIONS AFFECTED --------------------------------------------------- * Advertisement 6.x-2.x versions prior to 6.x-2.2. Drupal core is not affected. If you do not use the contributed Advertisement [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Advertisement module for Drupal 6.x, upgrade to Advertisement 6.x-2.3 [4] Also see the Advertisement [5] project page. -------- REPORTED BY --------------------------------------------------------- * Andrew Berry [6] -------- FIXED BY ------------------------------------------------------------ * Andrew Berry [7] * John Franklin [8], module maintainer -------- COORDINATED BY ------------------------------------------------------ * Matt Kleve [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team * Ivo Van Geertruyen [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/ad [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/ad [4] https://drupal.org/node/1580376 [5] http://drupal.org/project/ad [6] http://drupal.org/user/3734 [7] http://drupal.org/user/3734 [8] http://drupal.org/user/20938 [9] http://drupal.org/user/8264 [10] http://drupal.org/user/102818 [11] http://drupal.org/user/67 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-076 - Ubercart Product Keys Access Bypass
by security-news＠drupal.org 16 May '12

16 May '12

View online: http://drupal.org/node/1585532 * Advisory ID: DRUPAL-SA-CONTRIB-2012-076 * Project: Ubercart Product Keys [1] (third-party module) * Version: 6.x * Date: 2012-May-16 * Security risk: Moderately Critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- CVE: Requested. This module enables you to sell product keys from an Ubercart store. Under certain circumstances, a user can view all unassigned product keys which could grant them access to the software circumventing the process of selling the key. -------- VERSIONS AFFECTED --------------------------------------------------- * Ubercart Product Keys 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Ubercart Product Keys [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the uc_product_keys module for Drupal 6.x upgrade to uc_products_key 6.x-1.1 [4]. Also see the Ubercart Product Keys [5] project page. -------- REPORTED BY --------------------------------------------------------- * Daniel Glucksman -------- FIXED BY ------------------------------------------------------------ * Daniel Glucksman * Tony Freixas [6] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [7] of the Drupal Security Team * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/uc_product_keys [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/uc_product_keys [4] http://drupal.org/node/1580752 [5] http://drupal.org/project/uc_product_keys [6] http://drupal.org/user/131274 [7] http://drupal.org/user/36762 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-075 - Take Control - Cross Site Request Forgery (CSRF)
by security-news＠drupal.org 09 May '12

09 May '12

View online: http://drupal.org/node/1569512 * Advisory ID: DRUPAL-SA-CONTRIB-2012-075 * Project: Take Control [1] (third-party module) * Version: 6.x * Date: 2012-May-09 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to manage your Drupal file-system from within Drupal itself. The module does not sufficiently validate Ajax calls leading to possibility of a Cross Site Request Forgery CSRF attack. This vulnerability is mitigated by the fact that the attacker must be able to guess your Drupal file-system root path exactly. Further, if your site follows the secure file-system permissions recommendations [3] and the web-server account does not have write access to Drupal root, only files/folders in Drupal's "files" directory are open to manipulation. -------- VERSIONS AFFECTED --------------------------------------------------- * Take Control 6.x-2.x versions prior to 6.x-2.2. Drupal core is not affected. If you do not use the contributed Take Control [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Take Control module for Drupal 6.x, upgrade to Take Control 6.x-2.2 [5] Also see the Take Control [6] project page. -------- REPORTED BY --------------------------------------------------------- * Carl Wiedemann [7] -------- FIXED BY ------------------------------------------------------------ * Rahul Singla [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/take_control [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/244924 [4] http://drupal.org/project/take_control [5] http://drupal.org/node/1243604 [6] http://drupal.org/project/take_control [7] http://drupal.org/user/235047 [8] http://drupal.org/user/473356 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/102818 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-074 - Contact Forms - Access Bypass
by security-news＠drupal.org 09 May '12

09 May '12

View online: http://drupal.org/node/1569508 * Advisory ID: DRUPAL-SA-CONTRIB-2012-074 * Project: Contact Forms [1] (third-party module) * Version: 7.x * Date: 2012-May-09 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module expands the features of the site wide contact form. It eliminates the drop down category menu by generating a clean looking contact form (without a drop down menu) with a unique path for each of the contact form categories. The module allowed users to edit the Contact Form settings if they have permission to 'access the site-wide contact form' instead of more appropriate 'Administer contact forms and contact form settings' permission. This vulnerability is only mitigated by the fact that an attacker must know the correct url to access the Contact Forms settings page (though it is the same on all Drupal sites). -------- VERSIONS AFFECTED --------------------------------------------------- * Contact Forms 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Contact Forms [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Contact Forms module for Drupal 7.x, upgrade to Contact Forms 7.x-1.3 [4] Also see the Contact Forms [5] project page. -------- REPORTED BY --------------------------------------------------------- * Vlad D. [6] -------- FIXED BY ------------------------------------------------------------ * Geoff Davies [7] the module maintainer * Greg Knaddison [8] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/contact_forms [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/contact_forms [4] http://drupal.org/node/1569352 [5] http://drupal.org/project/contact_forms [6] http://drupal.org/user/1105838 [7] http://drupal.org/user/29262 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0