Drupal SMTP Authentication Support Module Information Disclosure Vulnerability

Bugtraq ID:	99327
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2017 12:00AM
Updated:	Jun 28 2017 12:00AM
Credit:	Baysaa
Vulnerable:	Drupal SMTP Authentication Support 8.x-1.0-beta2 Drupal SMTP Authentication Support 8.x-1.0-beta1 Drupal SMTP Authentication Support 7.x-1.6 Drupal SMTP Authentication Support 7.x-1.5 Drupal SMTP Authentication Support 7.x-1.4 Drupal SMTP Authentication Support 7.x-1.3 Drupal SMTP Authentication Support 7.x-1.2 Drupal SMTP Authentication Support 7.x-1.1 Drupal SMTP Authentication Support 7.x-1.0
Not Vulnerable:	Drupal SMTP Authentication Support 8.x-1.0-beta3 Drupal SMTP Authentication Support 7.x-1.7

Drupal SMTP Authentication Support Module Information Disclosure Vulnerability

The SMTP Authentication Support module for Drupal is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

The following products are affected:

smtp 8.x-1.x versions prior to 8.x-1.0-beta3.
smtp 7.x-1.x versions prior to 7.x-1.7.

Drupal SMTP Authentication Support Module Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Drupal SMTP Authentication Support Module Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal SMTP Authentication Support Module Information Disclosure Vulnerability

References:

• Drupal Homepage (Drupal)
  
• DRUPAL-SA-CONTRIB-2017-055: SMTP - Moderatley Critical - Information Disclosure (Drupal)