Drupal Commerce Skrill Module 'Moneybookers enterprise' Payment Method Access Bypass Vulnerability

Bugtraq ID:	58849
Class:	Access Validation Error
CVE:	CVE-2013-1924
Remote:	Yes
Local:	No
Published:	Apr 03 2013 12:00AM
Updated:	Apr 04 2013 06:57PM
Credit:	Julien Dubreuil
Vulnerable:
Not Vulnerable:

Drupal Commerce Skrill Module 'Moneybookers enterprise' Payment Method Access Bypass Vulnerability

The Commerce Skrill (formerly Moneybookers) module for Drupal is prone to an access-bypass vulnerability.

Successful exploits may allow an attacker to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

Commerce Skrill (formerly Moneybookers) versions prior to 7.x-1.2 are vulnerable.

Drupal Commerce Skrill Module 'Moneybookers enterprise' Payment Method Access Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Commerce Skrill Module 'Moneybookers enterprise' Payment Method Access Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Commerce Skrill Module 'Moneybookers enterprise' Payment Method Access Bypass Vulnerability

References:

• Drupal Homepage (Drupal)