Drupal Restrict Node Page View Module Security Bypass Vulnerability

Bugtraq ID:	54407
Class:	Access Validation Error
CVE:	CVE-2012-4473
Remote:	Yes
Local:	No
Published:	Jul 12 2012 12:00AM
Updated:	Oct 04 2012 02:10PM
Credit:	Jake Bell.
Vulnerable:
Not Vulnerable:

Drupal Restrict Node Page View Module Security Bypass Vulnerability

The Restrict node page view module for Drupal is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information; this may aid in launching further attacks.

Versions prior to Restrict node page view 7.x-1.2 are vulnerable.

Drupal Restrict Node Page View Module Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Drupal Restrict Node Page View Module Security Bypass Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for details.

Drupal Restrict Node Page View Module Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Restrict node page view Homepage (Drupal)
  
• SA-CONTRIB-2012-109 - Restrict node page view - Access bypass (Drupal)