[Security-news] SA-CONTRIB-2009-010 Plus 1 - Cross-site request forgery

[security-news at drupal.org]

 * Advisory ID: DRUPAL-SA-CONTRIB-2009-010
 * Project: Plus 1 (third-party module)
 * Version: 6.x
 * Date: 2009 March 18
 * Security risk: Not critical
 * Exploitable from: Remote
 * Vulnerability: Cross-site request forgery (CSRF)

-------- DESCRIPTION ---------------------------------------------------------

The Plus 1 module provides a voting widget for content that records votes
using Ajax.

The URL for voting is vulnerable to cross-site request forgeries (CSRF [1])
making it possible for users to unknowingly vote for content.

-------- VERSIONS AFFECTED ---------------------------------------------------

 * Versions of Plus 1 prior to 6.x-2.6

Drupal core is not affected. If you do not use the contributed Plus 1 module,
there is nothing you need to do.

-------- SOLUTION ------------------------------------------------------------

Install the latest version:

 * If you use Plus 1 for Drupal 6.x upgrade to Plus 1 6.x-2.6 [2]

See also the Plus 1 project page [3].

-------- REPORTED BY ---------------------------------------------------------

Greg Knaddison of the Drupal security team.

-------- FIXED BY ------------------------------------------------------------

Greg Knaddison, Ben Jeavons, Neil Drumm, and Caroline Schnapp.

-------- CONTACT -------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact [4].


[1] http://en.wikipedia.org/wiki/Csrf
[2] http://drupal.org/node/405672
[3] http://drupal.org/project/plus1
[4] http://drupal.org/contact