Drupal filedepot Module Session Management Security Bypass Vulnerability

Bugtraq ID:	53742
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 30 2012 12:00AM
Updated:	May 30 2012 12:00AM
Credit:	dolu
Vulnerable:	Drupal filedepot 6.X-1.2
Not Vulnerable:	Drupal filedepot 6.X-1.3

Drupal filedepot Module Session Management Security Bypass Vulnerability

The filedepot module for Drupal is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass security restrictions and obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

filedepot 6.x-1.x versions prior to 6.x-1.3 are vulnerable.

Drupal filedepot Module Session Management Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Drupal filedepot Module Session Management Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.


Drupal filedepot 6.X-1.2

• Drupal filedepot 6.x-1.3
  http://drupal.org/node/1598782

Drupal filedepot Module Session Management Security Bypass Vulnerability

References:

• Drupal Homepage (Drupal)
  
• filedepot Homepage (Drupal)
  
• SA-CONTRIB-2012-090 - File depot - Session Management Vulnerability (Drupal)