Drupal User Protect Cross Site Request Forgery Vulnerability

Bugtraq ID:	36922
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 04 2009 12:00AM
Updated:	Nov 04 2009 08:07PM
Credit:	Chad Phillips
Vulnerable:	Drupal User Protect 6.x-1.2 Drupal User Protect 5.x-1.3
Not Vulnerable:	Drupal User Protect 6.x-1.3 Drupal User Protect 5.x-1.4

Drupal User Protect Cross Site Request Forgery Vulnerability

Drupal User Protect is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible.

Drupal User Protect Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

Drupal User Protect Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for details.


Drupal User Protect 6.x-1.2

• Drupal userprotect-6.x-1.3t.ar.gz
  http://ftp.drupal.org/files/projects/userprotect-6.x-1.3.tar.gz

Drupal User Protect 5.x-1.3

• Drupal userprotect-5.x-1.4.tar.gz
  http://ftp.drupal.org/files/projects/userprotect-5.x-1.4.tar.gz

Drupal User Protect Cross Site Request Forgery Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-090 - User Protect - Cross Site Request Forgery (Drupal)