By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2012-131
  • Project: Email Field (third-party module)
  • Version: 6.x, 7.x
  • Date: 2012-August-29
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

Description

The email module provides a field type (CCK / FieldAPI) for storing email addresses. Furthermore, it provides a formatter to output the email address as a link to a contact form. The contact form formatter allows a site visitor to email the stored address without letting them see what that e-mail address is.

The module didn't sufficiently check access for the contact form page, allowing a site visitor to email the stored address on the entity without having access to the entity itself.

CVE: Requested

Versions affected

  • Email Field 6.x-1.x versions prior to 6.x-1.2.
  • Email Field 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Email Field module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Email Field project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x, Drupal 7.x