Drupal Ubercart Product Keys Module Access Security Bypass Vulnerability

Bugtraq ID:	53587
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 16 2012 12:00AM
Updated:	May 16 2012 12:00AM
Credit:	Daniel Glucksman
Vulnerable:	Drupal Ubercart Product Keys 6.X-1.X
Not Vulnerable:	Drupal Ubercart Product Keys 6.X-1.1

Drupal Ubercart Product Keys Module Access Security Bypass Vulnerability

The Ubercart Product Keys module for Drupal is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and view all unassigned product keys; this may aid in launching further attacks.

Ubercart Product Keys 6.x-1.x versions prior to 6.x-1.1 are vulnerable.

Drupal Ubercart Product Keys Module Access Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Drupal Ubercart Product Keys Module Access Security Bypass Vulnerability

Solution:
Updates are available; please see the references for more information.

Drupal Ubercart Product Keys Module Access Security Bypass Vulnerability

References:

• Drupal Homepage (Drupal)
  
• SA-CONTRIB-2012-076 - Ubercart Product Keys Access Bypass (Drupal)
  
• Ubercart Product Keys Homepage (Drupal)