Drupal Alfresco Module CVE-2015-3366 Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	74273
Class:	Input Validation Error
CVE:	CVE-2015-3366
Remote:	Yes
Local:	No
Published:	Jan 21 2015 12:00AM
Updated:	Jan 21 2015 12:00AM
Credit:	Pere Orga
Vulnerable:	Drupal Alfresco 6.x-1.2
Not Vulnerable:	Drupal Alfresco 6.x-1.3

Drupal Alfresco Module CVE-2015-3366 Multiple Cross Site Request Forgery Vulnerabilities

The Alfresco module for Drupal is prone to multiple cross-site request-forgery vulnerabilities.

An attacker can exploit these issues to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Drupal Alfresco Module CVE-2015-3366 Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.

Drupal Alfresco Module CVE-2015-3366 Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Alfresco Module CVE-2015-3366 Multiple Cross Site Request Forgery Vulnerabilities

References:

• Alfresco Homepage (Drupal)
  
• Drupal Homepage (Drupal)
  
• Re: Re: CVEs for Drupal contributed modules - January 2015 (MITRE CVE Numbering Authority)
  
• SA-CONTRIB-2015-024 - Alfresco - Cross Site Request Forgery (CSRF) (Drupal)