Drupal Prepopulate Module Security Bypass Vulnerability

Bugtraq ID:	42395
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 11 2010 12:00AM
Updated:	Aug 11 2010 12:00AM
Credit:	Aren Cambre
Vulnerable:
Not Vulnerable:

Drupal Prepopulate Module Security Bypass Vulnerability

The Prepopulate module for Drupal is prone to a security-bypass vulnerability.

Attackers may exploit these issues to bypass certain security restrictions and perform unauthorized actions.

Versions prior to Prepopulate 5.x-1.5 and 6.x-2.0 are vulnerable.
http://drupal.org/node/207891

Drupal Prepopulate Module Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Prepopulate Module Security Bypass Vulnerability

Solution:
Updates are available; please see the references for details.

Drupal Prepopulate Module Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Prepopulate Module Homepage (Drupal)
  
• SA-CONTRIB-2010-086 - Prepopulate - Access Bypass (Drupal)