[Security-news] SA-CONTRIB-2010-068 - Masquerade - Cross Site Request Forgery
securi...@drupal.org
* Project: Masquerade (third-party module)
* Version: 5.x, 6.x
* Date: 2010-June-23
* Security risk: Not critical
* Exploitable from: Remote
* Vulnerability: Cross Site Request Forgery
-------- DESCRIPTION
---------------------------------------------------------
The masquerade module is designed as a tool for site designers and
administrators, allowing a user with the right permissions to temporarily
masquerade as another user. The module is vulnerable to Cross Site Request
Forgeries (CSRF [1]) via the masquerade/switch and masquerade/unswitch paths.
-------- VERSIONS AFFECTED
---------------------------------------------------
* The unsupported Masquerade module for Drupal 5.x versions
* Masquerade module for Drupal 6.x versions prior to 6.x-1.4
Drupal core is not affected. If you do not use the contributed Masquerade [2]
module, there is nothing you need to do.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you use the unsupported Masquerade module for Drupal 5.x, either
disable the module or upgrade to the latest 6.x versions of Drupal core
and the Masquerade module.
* If you use the Masquerade module for Drupal 6.x upgrade to Masquerade
6.x-1.4 [3]
See also the Masquerade project page [4].
-------- REPORTED BY
---------------------------------------------------------
* Ivo Van Geertruyen (mr.baileys [5]) of the Drupal security team
* Peter Wolanin (pwolanin [6]) of the Drupal security team
-------- FIXED BY
------------------------------------------------------------
* Andrew Berry (deviantintegral [7]), module co-maintainer
* Allen Freeman (afreeman [8])
* Ivo Van Geertruyen (mr.baileys [9]) of the Drupal security team
-------- CONTACT
-------------------------------------------------------------
The Drupal security team [10] can be reached at security at drupal.org or via
the form at http://drupal.org/contact.
[1] http://en.wikipedia.org/wiki/Csrf
[2] http://drupal.org/project/masquerade
[3] http://drupal.org/node/835692
[4] http://drupal.org/project/Masquerade
[5] http://drupal.org/user/383424
[6] http://drupal.org/user/49851
[7] http://drupal.org/user/71291
[8] http://drupal.org/user/450370
[9] http://drupal.org/user/383424
[10] http://drupal.org/security-team
_______________________________________________
Security-news mailing list
Securi...@drupal.org
http://lists.drupal.org/mailman/listinfo/security-news