Drupal Autocomplete Widgets for Text and Number Fields Module Access Bypass Vulnerability

Bugtraq ID:	59279
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2013 12:00AM
Updated:	Apr 17 2013 12:00AM
Credit:	James and Cash Williams
Vulnerable:
Not Vulnerable:

Drupal Autocomplete Widgets for Text and Number Fields Module Access Bypass Vulnerability

The Autocomplete Widgets for Text and Number Fields module for Drupal is prone to an access-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

The following versions are affected:

Autocomplete Widgets 6.x-1.x versions prior to 6.x-1.4
Autocomplete Widgets 7.x-1.x versions prior to 7.x-1.0-rc1

Drupal Autocomplete Widgets for Text and Number Fields Module Access Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Autocomplete Widgets for Text and Number Fields Module Access Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Autocomplete Widgets for Text and Number Fields Module Access Bypass Vulnerability

References:

• Drupal Homepage (Drupal)