Drupal Content Construction Kit (CCK) Module Security Bypass Vulnerability

Bugtraq ID:	42400
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 11 2010 12:00AM
Updated:	Apr 13 2015 10:13PM
Credit:	Alexis Wilke
Vulnerable:	Yves Chedemois Content Construction Kit (CCK) 6.x-2.7 Yves Chedemois Content Construction Kit (CCK) 6.x-2.6
Not Vulnerable:	Yves Chedemois Content Construction Kit (CCK) 6.x-2.8

Drupal Content Construction Kit (CCK) Module Security Bypass Vulnerability

The Content Construction Kit (CCK) module for Drupal is prone to a security-bypass vulnerability.

Attackers may exploit this issue to bypass certain security restrictions and perform unauthorized actions.

Versions prior to Content Construction Kit (CCK) 6.x-2.8 are vulnerable.

Note: The issue may be related to BID 40938 (Drupal Content Construction Kit (CCK) Multiple Security Bypass Vulnerabilities).
http://drupal.org/node/207891

Drupal Content Construction Kit (CCK) Module Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Content Construction Kit (CCK) Module Security Bypass Vulnerability

Solution:
Updates are available; please see the references for details.


Yves Chedemois Content Construction Kit (CCK) 6.x-2.7

• Drupal SA-CONTRIB-2010-088 - Content Construction Kit (CCK) - Access Bypass
  http://ftp.drupal.org/files/projects/cck-6.x-2.8.tar.gz

Yves Chedemois Content Construction Kit (CCK) 6.x-2.6

• Drupal SA-CONTRIB-2010-088 - Content Construction Kit (CCK) - Access Bypass
  http://ftp.drupal.org/files/projects/cck-6.x-2.8.tar.gz

Drupal Content Construction Kit (CCK) Module Security Bypass Vulnerability

References:

• CCK Project Page (CCK)
  
• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2010-088 - Content Construction Kit (CCK) - Access Bypass (Drupal)