Drupal DRD Agent Module Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	98407
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 10 2017 12:00AM
Updated:	May 23 2017 04:25PM
Credit:	David Snopek
Vulnerable:	Drupal DRD Agent 8.x-3.0 Drupal DRD Agent 7.x-3.0
Not Vulnerable:	Drupal DRD Agent 8.x-3.1 Drupal DRD Agent 7.x-3.1

Drupal DRD Agent Module Multiple Cross Site Request Forgery Vulnerabilities

The DRD Agent module for Drupal is prone to multiple cross-site request-forgery vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

The following products are vulnerable:

DRD Agent 7.x-3.x versions prior to 7.x-3.1
DRD Agent 8.x-3.x versions prior to 8.x-3.1

Drupal DRD Agent Module Multiple Cross Site Request Forgery Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Drupal DRD Agent Module Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal DRD Agent Module Multiple Cross Site Request Forgery Vulnerabilities

References:

• Drupal Homepage (Drupal)
  
• DRD Agent - Critical - Multiple vulnerabilites - SA-CONTRIB-2017-047 (Drupal)