View online: https://www.drupal.org/node/2907118 * Advisory ID: DRUPAL-SA-CONTRIB-2017-072 * Project: Clientside Validation [1] (third-party module) * Version: 7.x * Date: 2017-September-06 * Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- The Clientside Validation module enables you to have clientside (Javascript) validation on your forms. The module does not sufficiently validate parameters of a POST request made when validating a CAPTCHA. For the 1.x version of this module, this vulnerability is mitigated by the fact that the CAPTCHA module must be enabled and the 'validate captcha' option of the Clientside Validation module must be enabled (this option is enabled by default). For the 2.x version of this module, this vulnerability is mitigated by the fact that the CAPTCHA module must be enabled and the Clientside Validation captcha submodule must be enabled. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Clientside Validation 7.x-1.x versions prior to 7.x-1.44. * Clientside Validation 7.x-2.x versions prior to 7.x-2.0-beta1. Drupal core is not affected. If you do not use the contributed Clientside Validation [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the 1.x version of Clientside Validation module for Drupal 7.x, upgrade to Clientside Validation 7.x-1.45 [5] * If you use the 2.x version of Clientside Validation module for Drupal 7.x, upgrade to Clientside Validation 7.x-2.0-beta2 [6] Also see the Clientside Validation [7] project page. -------- REPORTED BY --------------------------------------------------------- * Daniel-SCRT [8] -------- FIXED BY ------------------------------------------------------------ * Jelle Sebreghts [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/clientside_validation [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/clientside_validation [5] https://www.drupal.org/project/clientside_validation/releases/7.x-1.45 [6] https://www.drupal.org/project/clientside_validation/releases/7.x-2.0-beta2 [7] https://www.drupal.org/project/clientside_validation [8] https://www.drupal.org/u/daniel-scrt [9] https://www.drupal.org/u/jelle_s [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity