Views Module for Drupal 'views_ajax_autocomplete_user' Authentication Bypass Vulnerability

Bugtraq ID:	41318
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 02 2010 12:00AM
Updated:	Jul 02 2010 12:00AM
Credit:	Mad Irish
Vulnerable:	Drupal Views 6.X-2.11 Drupal Views 6.X-2.10
Not Vulnerable:

Views Module for Drupal 'views_ajax_autocomplete_user' Authentication Bypass Vulnerability

The Views module for Drupal is prone to an authentication-bypass vulnerability.

Attackers can exploit this issue to gain unauthorized access to certain portions of the affected application and perform unauthorized actions.

Views 6.x-2.10 and 6.x-2.11are vulnerable; other versions may be affected.
http://drupal.org/node/207891

Views Module for Drupal 'views_ajax_autocomplete_user' Authentication Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Views Module for Drupal 'views_ajax_autocomplete_user' Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Views Module for Drupal 'views_ajax_autocomplete_user' Authentication Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Drupal Views Module Information Disclosure Vulnerability (Mad Irish)
  
• Views Homepage (Drupal)