Drupal Meta tags (Nodewords) Module Unauthorized Access Vulnerability

Bugtraq ID:	36506
Class:	Access Validation Error
CVE:	CVE-2009-3442
Remote:	Yes
Local:	No
Published:	Sep 23 2009 12:00AM
Updated:	Apr 13 2015 09:06PM
Credit:	Barry Jaspan and Ben Jeavons of the Drupal Security Team
Vulnerable:	Drupal Meta tags (Nodewords) 6.x-1.0
Not Vulnerable:	Drupal Meta tags (Nodewords) 6.x-1.1

Drupal Meta tags (Nodewords) Module Unauthorized Access Vulnerability

The Drupal Meta tags (Nodewords) module is prone to an unauthorized-access vulnerability because it fails to adequately enforce access permissions.

An attacker can exploit this vulnerability to gain unauthorized access to the application; other attacks may also possible.

Versions prior to Meta tags (Nodewords) 6.x-1.1 are vulnerable.

Drupal Meta tags (Nodewords) Module Unauthorized Access Vulnerability

Attackers may exploit this issue via a browser.

Drupal Meta tags (Nodewords) Module Unauthorized Access Vulnerability

Solution:
Updates are available. Please see the references for details.


Drupal Meta tags (Nodewords) 6.x-1.0

• Drupal nodewords-6.x-1.1.tar.gz
  http://ftp.drupal.org/files/projects/nodewords-6.x-1.1.tar.gz

Drupal Meta tags (Nodewords) Module Unauthorized Access Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Nodewords Homepage (Drupal)
  
• SA-CONTRIB-2009-060 - Meta tags (Nodewords) - Access bypass (Drupal)