By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2012-065
  • Project: Site Documentation (third-party module)
  • Version: 6.x
  • Date: 2012-April-25
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Information Disclosure

Description

CVE: CVE-2012-2302

This module enables you to display a plethora of information about your site's structure. Optionally, the information may be saved into a file for later comparison.

The module doesn't sufficiently verify that the saved file is protected by the Private File System.

This vulnerability is mitigated by the fact that the administrator must have configured the module to save the HTML report file to disk.

Versions affected

  • Sitedoc 6.x-1.x versions prior to 6.x-1.4.

Drupal core is not affected. If you do not use the contributed Site Documentation module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Sitedoc module for Drupal 6.x, upgrade to Sitedoc 6.x-1.4, and
  • Enable the private file system if you want to save the output file.

Also see the Site Documentation project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x