Project: 
Cloud
Date: 
2017-November-29
Security risk: 
Critical 18∕25 AC:None/A:User/CI:Some/II:All/E:Theoretical/TD:All
Vulnerability: 
CSRF
Description: 

This module enables sites to manage public clouds like Amazon EC2 and also private clouds like OpenStack.

The module doesn't sufficiently protect the deletion of audit reports, thereby exposing a cross-site request vulnerability which can be exploited by unprivileged users to trick an administrator into unwanted deletion of audit reports.

This vulnerability is mitigated by the fact that the victim must have a role with the permission "access audit report".

Solution: 

Install the latest version:

  • If you use the Cloud module for Drupal 7, upgrade to Cloud 7.x-1.7
Reported By: 
Fixed By: 
Coordinated By: