By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2010-086
  • Project: Prepopulate (third-party module)
  • Version: 5.x and 6.x
  • Date: 2010-Aug-11
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Access Bypass

Description

The Prepopulate module provides the ability for form fields to be pre-populated via the request sent for the form.

The module is vulnerable to access bypass which would allow a malicious user to change the value of fields they would not otherwise have access to alter.

Versions affected

  • Prepopulate module for Drupal 6.x versions prior to 6.x-2.0
  • Prepopulate module for Drupal 5.x versons prior to 5.x-1.5

Drupal core is not affected. If you do not use the contributed Prepopulate module, there is nothing you need to do.

Solution

Install the latest version:

See also the Prepopulate project page.

Reported by

Fixed by

  • Joshua Brauer (jbrauer) the module maintainer

Contact

The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact.

⋅ Categories: Drupal 5.x, Drupal 6.x