Drupal Core 'drupal_valid_token()' Function Access Bypass Vulnerability
BID:63849
Info
Drupal Core 'drupal_valid_token()' Function Access Bypass Vulnerability
| Bugtraq ID: | 63849 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2013 12:00AM |
| Updated: | Nov 20 2013 12:00AM |
| Credit: | Heine Deelstra |
| Vulnerable: |
Drupal Drupal 7.x-1.x-dev Drupal Drupal 7.X Drupal Drupal 7.6 Drupal Drupal 7.5 Drupal Drupal 7.4 Drupal Drupal 7.3 Drupal Drupal 7.23 Drupal Drupal 7.20 Drupal Drupal 7.2 Drupal Drupal 7.19 Drupal Drupal 7.18 Drupal Drupal 7.17 Drupal Drupal 7.16 Drupal Drupal 7.15 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 Drupal Drupal 7.1 Drupal Drupal 7.0 Dev Drupal Drupal 7.0 Alpha7 Drupal Drupal 7.0 Alpha6 Drupal Drupal 7.0 Alpha5 Drupal Drupal 7.0 Alpha4 Drupal Drupal 7.0 Alpha3 Drupal Drupal 7.0 Alpha2 Drupal Drupal 7.0 Alpha1 Drupal Drupal 7.0 Drupal Drupal 6.x-1.12 Drupal Drupal 6.X Drupal Drupal 6.9 Drupal Drupal 6.8 Drupal Drupal 6.7 Drupal Drupal 6.6 Drupal Drupal 6.5 Drupal Drupal 6.4 Drupal Drupal 6.3 Drupal Drupal 6.28 Drupal Drupal 6.27 Drupal Drupal 6.26 Drupal Drupal 6.23 Drupal Drupal 6.22 Drupal Drupal 6.22 Drupal Drupal 6.21 Drupal Drupal 6.21 Drupal Drupal 6.2 Drupal Drupal 6.18 Drupal Drupal 6.17 Drupal Drupal 6.16 Drupal Drupal 6.15 Drupal Drupal 6.15 Drupal Drupal 6.14 Drupal Drupal 6.13 Drupal Drupal 6.12 Drupal Drupal 6.11 Drupal Drupal 6.10 Drupal Drupal 6.1 Drupal Drupal 6.0 Rc4 Drupal Drupal 6.0 Rc3 Drupal Drupal 6.0 Rc2 Drupal Drupal 6.0 Rc1 Drupal Drupal 6.0 Dev Drupal Drupal 6.0 Beta4 Drupal Drupal 6.0 Beta3 Drupal Drupal 6.0 Beta2 Drupal Drupal 6.0 Beta1 |
| Not Vulnerable: |
Drupal Drupal 7.24 Drupal Drupal 6.29 |
Discussion
Drupal Core 'drupal_valid_token()' Function Access Bypass Vulnerability
Drupal is prone to an access-bypass vulnerability.
Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions.
Drupal core 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.
Drupal is prone to an access-bypass vulnerability.
Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions.
Drupal core 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.
Exploit / POC
Drupal Core 'drupal_valid_token()' Function Access Bypass Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
Drupal Core 'drupal_valid_token()' Function Access Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Drupal Core 'drupal_valid_token()' Function Access Bypass Vulnerability
References:
References:
- Drupal Language Switcher Dropdown Homepage (Drupal)
- Drupal Core page (Drupal)
- SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities (Drupal)