Drupal CCK Comment Reference Module Node Title Security Bypass Vulnerability

Bugtraq ID:	36863
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 28 2009 12:00AM
Updated:	Oct 29 2009 04:57PM
Credit:	Ben Jeavons
Vulnerable:	Drupal CCK Comment Reference 6.x-1.2 Drupal CCK Comment Reference 6.x-1.1 Drupal CCK Comment Reference 5.x-1.1
Not Vulnerable:	Drupal CCK Comment Reference 6.x-1.3 Drupal CCK Comment Reference 5.x-1.2

Drupal CCK Comment Reference Module Node Title Security Bypass Vulnerability

The CCK Comment Reference module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

This issue affects versions prior to CCK Comment Reference 5.x-1.2 and 6.x-1.3.

Drupal CCK Comment Reference Module Node Title Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Drupal CCK Comment Reference Module Node Title Security Bypass Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for details.


Drupal CCK Comment Reference 5.x-1.1

• Drupal commentreference-5.x-1.2.tar.gz
  http://ftp.drupal.org/files/projects/commentreference-5.x-1.2.tar.gz

Drupal CCK Comment Reference 6.x-1.2

• Drupal commentreference-6.x-1.3.tar.gz
  http://ftp.drupal.org/files/projects/commentreference-6.x-1.3.tar.gz

Drupal CCK Comment Reference Module Node Title Security Bypass Vulnerability

References:

• CCK comment reference Homepage (Drupal)
  
• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-083 - CCK Comment Reference - Access Bypass (Drupal)