Drupal Author Pane Module Security Bypass Vulnerability

Bugtraq ID:	49503
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2011 12:00AM
Updated:	Sep 07 2011 12:00AM
Credit:	Tony Brooke (silentway) and Skispcs
Vulnerable:	Drupal Author Pane 6.x-2.x
Not Vulnerable:	Drupal Author Pane 6.X-2.2

Drupal Author Pane Module Security Bypass Vulnerability

The Author Pane module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

Author Pane versions 6.x prior to 6.x-2.2 are vulnerable.

Drupal Author Pane Module Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Author Pane Module Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.

Drupal Author Pane Module Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Product Homepage (Drupal)
  
• SA-CONTRIB-2011-040 Author Pane access bypass (DRUPAL)