By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2012-106
  • Project: Listhandler (third-party module)
  • Version: 6.x
  • Date: 2012-July-11
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

Description

Listhandler is a module that marries mailing list discussions and Drupal forums.
The module doesn't sufficiently check the permissions of comment authors when importing emails.

CVE: CVE-2012-4470

Versions affected

  • All Listhandler 6.x-1.x versions.

Drupal core is not affected. If you do not use the contributed Listhandler module, there is nothing you need to do.

Solution

Install listhandler 6.x-1.1

Also see the Listhandler project page.

Reported by

Fixed by

Update: 2012-10-22 This module has been fixed: Download and install listhandler 6.x-1.1

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x