Drupal For Firebug Cross Site Request Forgery Vulnerability

Bugtraq ID:	45427
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 15 2010 12:00AM
Updated:	Dec 15 2010 12:00AM
Credit:	mr.baileys
Vulnerable:	Matt Cheney Drupal For Firebug 6.X-1.3 Matt Cheney Drupal For Firebug 5.X-1.4
Not Vulnerable:	Matt Cheney Drupal For Firebug 6.X-1.4 Matt Cheney Drupal For Firebug 5.X-1.5

Drupal For Firebug Cross Site Request Forgery Vulnerability

Drupal For Firebug is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Versions prior to Drupal For Firebug 5.x-1.5 and 6.x-1.4 are vulnerable.

Drupal For Firebug Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.

Drupal For Firebug Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the reference for more details.


Matt Cheney Drupal For Firebug 5.X-1.4

• Matt Cheney drupalforfirebug-5.x-1.5.tar.gz
  http://drupal.org/node/998568/

Matt Cheney Drupal For Firebug 6.X-1.3

• Matt Cheney drupalforfirebug-6.x-1.4.tar.gz
  http://drupal.org/node/998566

Drupal For Firebug Cross Site Request Forgery Vulnerability

References:

• Drupal Homepage (Drupal)
  
• SA-CONTRIB-2010-105 - Outline Designer - Cross Site Request Forgery (Drupal)
  
• SA-CONTRIB-2010-110 - Drupal For Firebug - Cross-site Request Forgery (Drupal)