Drupal Simple Access Module Security Bypass Vulnerability

Bugtraq ID:	28720
Class:	Access Validation Error
CVE:	CVE-2008-1731
Remote:	Yes
Local:	No
Published:	Apr 10 2008 12:00AM
Updated:	May 07 2015 05:30PM
Credit:	Derek Wright of the Drupal Security Team
Vulnerable:	Drupal Simple Access Module 5.x-1.2-2
Not Vulnerable:	Drupal Simple Access Module 5.x-1.3

Drupal Simple Access Module Security Bypass Vulnerability

The Simple Access module for Drupal is prone to a security-bypass vulnerability because the application fails to properly maintain privacy information for a node.

Attackers can exploit these issues to bypass certain security restrictions and obtain potentially sensitive information that may lead to other attacks.

Versions prior to Simple Access 5.x-1.3 are vulnerable.

Drupal Simple Access Module Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Simple Access Module Security Bypass Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.


Drupal Simple Access Module 5.x-1.2-2

• Drupal simple_access-5.x-1.3.tar.gz
  http://ftp.drupal.org/files/projects/simple_access-5.x-1.3.tar.gz

Drupal Simple Access Module Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Simple Access Module Homepage (Drupal)