By Heine on
  • Advisory ID: DRUPAL-SA-2008-014
  • Project: Userpoints (third-party module)
  • Version: 4.7.x, 5.x-2.x, 5.x-3.x
  • Date: 2008-January-30
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross site request forgery

Description

Userpoints is a system for keeping track of points earned on a site. It can be used to reward users for contributions to a community and also for ecommerce transactions.

The Drupal Forms API protects against cross site request forgeries (CSRF), where a malicious site can cause a user to unintentionally submit a form to another site where they are authenticated. The point moderation form does not follow the standard Forms API submission model and is therefore not protected against this type of attack. A CSRF attack may result in the acceptance or decline of points which were in moderation.

Versions affected

  • Userpoints for Drupal 4.7.x before Userpoints 4.7.x-2.3
  • Userpoints for Drupal 5.x before Userpoints 5.x-3.3 or 5.x-2.16

Drupal core is not affected. If you do not use the contributed Userpoints module, there is nothing you need to do.

Solution

Install the latest version:

See also the User points project page.

Reported by

Greg Knaddison (greggles) of the Drupal Security Team.

Contact

The security contact for Drupal can be reached via email at security at drupal.org or via the form at http://drupal.org/contact.