View online: https://www.drupal.org/sa-contrib-2017-084
Project: Domain Integration [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass
Description: This module enables you to integrate the Domain module with other popular Drupal modules. The Domain Integration Login Restrict sub-module enables you to restrict access to a domain based on the assigned domains on a user.
The Domain Integration Login Restrict sub-module doesn't sufficiently check these restrictions when using one-time logins.
This vulnerability is mitigated by the fact that an attacker must have an active account on one of the domains.
Solution: Install the latest version:
* If you use the Domain Integration module for Drupal 7.x, upgrade to Domain Integration 7.x-1.2 [3]
Reported By: * Dominique Climenti [4]
Fixed By: * Dominique Climenti [5] * Len Swaneveld [6] the module maintainer * Niels de Feyter [7] the module maintainer * David Rothstein [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team
Coordinated By: * David Rothstein [10] of the Drupal Security Team
[1] https://www.drupal.org/project/domain_integration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/domain_integration/releases/7.x-1.2 [4] https://www.drupal.org/user/3549871 [5] https://www.drupal.org/user/3549871 [6] https://www.drupal.org/user/690914 [7] https://www.drupal.org/user/599438 [8] https://www.drupal.org/user/124982 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/124982