Drupal Ubercart Cross Site Request Forgery and Security Bypass Vulnerabilities

Bugtraq ID:	37058
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2009 12:00AM
Updated:	Nov 18 2009 11:56PM
Credit:	Daniel Duvall
Vulnerable:	Drupal Ubercart 6.x-2.0 Drupal Ubercart 5.x-1.8
Not Vulnerable:	Drupal Ubercart 6.X-2.1 Drupal Ubercart 5.x-1.9

Drupal Ubercart Cross Site Request Forgery and Security Bypass Vulnerabilities

Drupal Ubercart is prone to a cross-site request-forgery vulnerability and a security-bypass vulnerability.

Exploiting these issues may allow a remote attacker to perform certain administrative actions, bypass certain security restrictions, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible.

Drupal Ubercart Cross Site Request Forgery and Security Bypass Vulnerabilities

An attacker can exploit these issues through a browser. To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into following a malicious URI.

Drupal Ubercart Cross Site Request Forgery and Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references for details.


Drupal Ubercart 5.x-1.8

• Drupal ubercart-5.x-1.9.tar.gz
  http://ftp.drupal.org/files/projects/ubercart-5.x-1.9.tar.gz

Drupal Ubercart 6.x-2.0

• Drupal ubercart-6.x-2.1.tar.gz
  http://ftp.drupal.org/files/projects/ubercart-6.x-2.1.tar.gz

Drupal Ubercart Cross Site Request Forgery and Security Bypass Vulnerabilities

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-107 - Ubercart - Access bypass, Cross site request forgery (Drupal)