You are here: Home » NewsFeeds » PRLP – Critical – Access Bypass and Privilege Escalation – SA-CONTRIB-2017-030

PRLP – Critical – Access Bypass and Privilege Escalation – SA-CONTRIB-2017-030

Advisory ID: DRUPAL-SA-CONTRIB-2017-030
Project: Password Reset Landing Page (PRLP) (third-party module)
Version: 8.x
Date: 2017-March-08
Security risk: 16/25 ( Critical) AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Access bypass, Privilege escalation
Description
This module adds a form on the password-reset-landing page to allow changing the password of the user during the log in process.
The module does not sufficiently validate all access tokens, which allows an attacker to change the password of any arbitrary user and gain access to their account.
In order to exploit, the attacker must have an active account on the site.

CVE identifier(s) issued
A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
PRLP versions prior to 8.x-1.3
Drupal core is not affected. If you do not use the contributed Password Reset Landing Page (PRLP) module, there is nothing you need to do.
Solution
Install the latest version:
If you use the PRLP module for Drupal 8.x, upgrade to PRLP 8.x-1.3 (the latest 8.x release as of this


 

Original article