Drupal Comment Page Module Security Bypass Vulnerability

Bugtraq ID:	40276
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 19 2010 12:00AM
Updated:	May 19 2010 12:00AM
Credit:	Peter Wolanin, John Morahan, Dylan Tack, Kieran Lal, Ivo Van Geertruyen, Martin Barbella, Brandon Bergren, George Gongadze
Vulnerable:	Drupal Comment Page 6.x-1.1 Drupal Comment Page 5.x-1.1
Not Vulnerable:

Drupal Comment Page Module Security Bypass Vulnerability

The Comment Page module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

Comment Page versions 5.x-1.1 and 6.x-1.1 are affected; other versions may also be vulnerable.

Drupal Comment Page Module Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Drupal Comment Page Module Security Bypass Vulnerability

Solution:
This package has been abandoned; vendor-supplied fixes are not expected. Please see the references for more information.

Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Drupal Comment Page Module Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2010-052 - Multiple vulnerabilities in multiple contributed modules (Drupal)