View online: https://www.drupal.org/sa-contrib-2017-084 Project: Domain Integration [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description:  This module enables you to integrate the Domain module with other popular Drupal modules. The Domain Integration Login Restrict sub-module enables you to restrict access to a domain based on the assigned domains on a user. The Domain Integration Login Restrict sub-module doesn't sufficiently check these restrictions when using one-time logins. This vulnerability is mitigated by the fact that an attacker must have an active account on one of the domains. Solution:  Install the latest version: * If you use the Domain Integration module for Drupal 7.x, upgrade to Domain Integration 7.x-1.2 [3] Reported By:  * Dominique Climenti [4] Fixed By:  * Dominique Climenti [5] * Len Swaneveld [6] the module maintainer * Niels de Feyter [7] the module maintainer * David Rothstein [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team Coordinated By:  * David Rothstein [10] of the Drupal Security Team [1] https://www.drupal.org/project/domain_integration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/domain_integration/releases/7.x-1.2 [4] https://www.drupal.org/user/3549871 [5] https://www.drupal.org/user/3549871 [6] https://www.drupal.org/user/690914 [7] https://www.drupal.org/user/599438 [8] https://www.drupal.org/user/124982 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/124982