RETIRED: Drupal Realname User Reference Widget Module Information Disclosure Vulnerability

Bugtraq ID:	38255
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 16 2010 12:00AM
Updated:	Mar 01 2010 06:42PM
Credit:	Martin Barbella
Vulnerable:	Drupal Realname User Reference Widget 6.x-1.0
Not Vulnerable:

RETIRED: Drupal Realname User Reference Widget Module Information Disclosure Vulnerability

The Drupal 'Realname User Reference Widget' module is prone to an information-disclosure vulnerability because it fails to adequately restrict access to sensitive information.

To exploit this issue, attackers require 'access content' permissions, which may be granted with anonymous access.

Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

Realname User Reference Widget 6.x-1.0 is vulnerable; other versions may also be affected.

RETIRED (March 1, 2010): This BID describes intended behavior; it is being retired.

RETIRED: Drupal Realname User Reference Widget Module Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

RETIRED: Drupal Realname User Reference Widget Module Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Drupal Realname User Reference Widget Module Information Disclosure Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Realname User Reference Widget Homepage (Drupal)
  
• Information disclosure vulnerability in Drupal's Realname User Reference Widget (Martin Barbella )
  
• Re: Information disclosure vulnerability in Drupal's Realname User Reference Wid ([email protected])