Drupal Registration Codes Module Security Bypass Vulnerability

Bugtraq ID:	51271
Class:	Access Validation Error
CVE:	CVE-2012-1623
Remote:	Yes
Local:	No
Published:	Jan 04 2012 12:00AM
Updated:	Aug 30 2013 12:13AM
Credit:	Thomas Bonte (toemaz)
Vulnerable:	Gentoo Linux Drupal Registration Codes 6.X-2.3
Not Vulnerable:	Drupal Registration Codes 6.X-2.4

Drupal Registration Codes Module Security Bypass Vulnerability

Registration Codes module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions to perform unauthorized actions; this may aid in launching further attacks.

Registration Codes versions prior to 6.x-2.4 are vulnerable.

Drupal Registration Codes Module Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Registration Codes Module Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.

Drupal Registration Codes Module Security Bypass Vulnerability

References:

• Drupal Homepage (Drupal)
  
• SA-CONTRIB-2012-001 - Registration Codes - Access bypass (Drupal)