Drupal Content Construction Kit (CCK) Multiple Security Bypass Vulnerabilities

Bugtraq ID:	40938
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 16 2010 12:00AM
Updated:	Jun 21 2010 10:38PM
Credit:	recrit; Marc Ferran (markus_petrux) module co-maintainer
Vulnerable:	Yves Chedemois Content Construction Kit (CCK) 6.x-2.x Yves Chedemois Content Construction Kit (CCK) 5.x-1.x Red Hat Fedora 13 Red Hat Fedora 12 Red Hat Fedora 11
Not Vulnerable:	Yves Chedemois Content Construction Kit (CCK) 6.x-2.7 Yves Chedemois Content Construction Kit (CCK) 5.x-1.11

Drupal Content Construction Kit (CCK) Multiple Security Bypass Vulnerabilities

The Content Construction Kit (CCK) module for Drupal is prone to multipl security-bypass vulnerabilities that may allow attackers to perform actions without proper authorization.

Attackers can exploit these issues to bypass security restrictions to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

The following versions are vulnerable:

Content Construction Kit (CCK) 5.x versions prior to 5.x-1.11
Content Construction Kit (CCK) 6.x versions prior to 6.x-2.7

Drupal Content Construction Kit (CCK) Multiple Security Bypass Vulnerabilities

Attackers can exploit this issue through a browser.

Drupal Content Construction Kit (CCK) Multiple Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references for details.