Drupal Masquerade Module Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	41089
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 23 2010 12:00AM
Updated:	Jun 23 2010 12:00AM
Credit:	Ivo Van Geertruyen and Peter Wolanin of the Drupal Security Team
Vulnerable:	Drupal Masquerade 6.x-1.3 Drupal Masquerade 5.x
Not Vulnerable:	Drupal Masquerade 6.x-1.4

Drupal Masquerade Module Multiple Cross Site Request Forgery Vulnerabilities

The Masquerade module for Drupal is prone to multiple cross-site request-forgery vulnerabilities

Attackers can exploit these issues to perform certain administrative actions and gain unauthorized access to the affected application.

Versions prior to Masquerade 6.x-1.4 are vulnerable.

Drupal Masquerade Module Multiple Cross Site Request Forgery Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Drupal Masquerade Module Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Drupal Masquerade 5.x

• Drupal masquerade-6.x-1.4.tar.gz
  http://ftp.drupal.org/files/projects/masquerade-6.x-1.4.tar.gz

Drupal Masquerade 6.x-1.3

• Drupal masquerade-6.x-1.4.tar.gz
  http://ftp.drupal.org/files/projects/masquerade-6.x-1.4.tar.gz

Drupal Masquerade Module Multiple Cross Site Request Forgery Vulnerabilities

References:

• Drupal Homepage (Drupal)
  
• DRUPAL-SA-CONTRIB-2010-068 - Masquerade - Cross Site Request Forgery (Drupal)
  
• Masquerade Module Homepage (Drupal)