Drupal 'Printer, e-mail and PDF versions' Module Local File Access Information Disclosure Weakness

Bugtraq ID:	42397
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 11 2010 12:00AM
Updated:	Aug 11 2010 12:00AM
Credit:	Douglas Bagnall
Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.10 Drupal Printer, e-mail and PDF versions 5.x-4.9
Not Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.11 Drupal Printer, e-mail and PDF versions 5.x-4.10

Drupal 'Printer, e-mail and PDF versions' Module Local File Access Information Disclosure Weakness

Drupal 'Printer, e-mail and PDF versions' module is prone to an information-disclosure weakness.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

The following products are affected:

Printer, e-mail and PDF versions 6.x prior to 6.x-1.11
Printer, e-mail and PDF versions 5.x prior to 5.x-4.10

Drupal 'Printer, e-mail and PDF versions' Module Local File Access Information Disclosure Weakness

Attackers can use a browser to exploit this issue.

Drupal 'Printer, e-mail and PDF versions' Module Local File Access Information Disclosure Weakness

Solution:
Updates are available; please see the references for more information.

Drupal 'Printer, e-mail and PDF versions' Module Local File Access Information Disclosure Weakness

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2010-082 - Print - Local file read access (Drupal)