Drupal Entity API Module Multiple Access Bypass Vulnerabilities

Bugtraq ID:	64729
Class:	Input Validation Error
CVE:	CVE-2014-1398 CVE-2014-1399 CVE-2014-1400
Remote:	Yes
Local:	No
Published:	Jan 08 2014 12:00AM
Updated:	Apr 13 2015 10:17PM
Credit:	Clemens Tolboom, Ezra Barnett Gildesgame and Neil Drumm of the Drupal Security Team.
Vulnerable:	Drupal Entity API 7.x-1.2 Drupal Entity API 7.x-1.0
Not Vulnerable:	Drupal Entity API 7.x-1.3

Drupal Entity API Module Multiple Access Bypass Vulnerabilities

The Entity API module for Drupal is prone to multiple access-bypass vulnerabilities.

Successfully exploiting these issues may allow an attacker to bypass certain security restrictions and perform unauthorized actions.

Entity API 7.x-1.x versions prior to 7.x-1.3 are vulnerable.

Drupal Entity API Module Multiple Access Bypass Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

Drupal Entity API Module Multiple Access Bypass Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Entity API Module Multiple Access Bypass Vulnerabilities

References:

• Entity API Homepage (Drupal)
  
• SA-CONTRIB-2014-001 - Entity API - Access Bypass (Drupal)