Drupal Password Policy Module Security Bypass Weakness

Bugtraq ID:	68114
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 18 2014 12:00AM
Updated:	Jun 18 2014 12:00AM
Credit:	Ryan Courtnage and AohRveTPV
Vulnerable:	Drupal Password Policy 6.X-1.6 Drupal Password Policy 6.X-1.5 Drupal Password Policy 6.X-1.4 Drupal Password Policy 6.X-1.0
Not Vulnerable:	Drupal Password Policy 6.X-1.7

Drupal Password Policy Module Security Bypass Weakness

The Password Policy module for Drupal is prone to a security-bypass weakness.

An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions.

Password Policy prior to 6.x-1.7 are vulnerable.

Drupal Password Policy Module Security Bypass Weakness

Attackers can use a browser to exploit this issue.

Drupal Password Policy Module Security Bypass Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Password Policy Module Security Bypass Weakness

References:

• Drupal Homepage (Drupal)
  
• Password policy Homepage (Drupal)
  
• SA-CONTRIB-2014-062 -Passsword Policy - Multiple vulnerabilities (Drupal)