Drupal Autocomplete Widgets for CCK Text and Number Module Information Disclosure Vulnerability

Bugtraq ID:	37536
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 30 2009 12:00AM
Updated:	Dec 30 2009 10:12PM
Credit:	mr.baileys
Vulnerable:	Drupal Autocomplete Widgets for CCK Text and Number 6.x-1.2
Not Vulnerable:	Drupal Autocomplete Widgets for CCK Text and Number 6.x-1.3

Drupal Autocomplete Widgets for CCK Text and Number Module Information Disclosure Vulnerability

The Drupal 'Autocomplete Widgets for CCK Text and Number' module is prone to an information-disclosure vulnerability because it fails to follow CCK access permissions.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Versions prior to 'Autocomplete Widgets for CCK Text and Number' 6.x-1.3 are vulnerable.

Drupal Autocomplete Widgets for CCK Text and Number Module Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

Drupal Autocomplete Widgets for CCK Text and Number Module Information Disclosure Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for more information.


Drupal Autocomplete Widgets for CCK Text and Number 6.x-1.2

• Drupal autocomplete_widgets-6.x-1.3.tar.gz
  http://ftp.drupal.org/files/projects/autocomplete_widgets-6.x-1.3.tar. gz

Drupal Autocomplete Widgets for CCK Text and Number Module Information Disclosure Vulnerability

References:

• Autocomplete Widgets for CCK Text and Number Homepage (Drupal)
  
• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-115 - Autocomplete Widgets for CCK Text and Number - Information (Drupal)