Voting starts in March for the Drupal Association Board election.
- Advisory ID: DRUPAL-SA-CONTRIB-2012-065
- Project: Site Documentation (third-party module)
- Version: 6.x
- Date: 2012-April-25
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Information Disclosure
This module enables you to display a plethora of information about your site's structure. Optionally, the information may be saved into a file for later comparison.
The module doesn't sufficiently verify that the saved file is protected by the Private File System.
This vulnerability is mitigated by the fact that the administrator must have configured the module to save the HTML report file to disk.
- Sitedoc 6.x-1.x versions prior to 6.x-1.4.
Drupal core is not affected. If you do not use the contributed Site Documentation module, there is nothing you need to do.
Install the latest version:
- If you use the Sitedoc module for Drupal 6.x, upgrade to Sitedoc 6.x-1.4, and
- Enable the private file system if you want to save the output file.
Also see the Site Documentation project page.
- Jakub Suchý of the Drupal Security Team
- Nancy Wichmann, the module maintainer
- Forest Monsen of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.