Drupal Contact Form Fields Module Multiple Cross Site Request Forgery Vulnerabilities
BID:72118
Info
Drupal Contact Form Fields Module Multiple Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 72118 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-3363 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 14 2015 12:00AM |
| Updated: | May 12 2015 07:38PM |
| Credit: | Pere Orga |
| Vulnerable: |
Drupal Contact Form Fields 6.X-2.2 Drupal Contact Form Fields 6.X-2.1 Drupal Contact Form Fields 6.X-2.0 |
| Not Vulnerable: |
Drupal Contact Form Fields 6.X-2.3 |
Discussion
Drupal Contact Form Fields Module Multiple Cross Site Request Forgery Vulnerabilities
The Contact Form Fields module for Drupal is prone to multiple cross-site request-forgery vulnerabilities.
An attacker can exploit these issues to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Contact Form Fields prior to 6.x-2.3 are vulnerable.
The Contact Form Fields module for Drupal is prone to multiple cross-site request-forgery vulnerabilities.
An attacker can exploit these issues to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Contact Form Fields prior to 6.x-2.3 are vulnerable.
Exploit / POC
Drupal Contact Form Fields Module Multiple Cross Site Request Forgery Vulnerabilities
To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.
To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.
Solution / Fix
Drupal Contact Form Fields Module Multiple Cross Site Request Forgery Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Drupal Contact Form Fields Module Multiple Cross Site Request Forgery Vulnerabilities
References:
References:
- Drupal Homepage (Drupal)