Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
By Drupal Security Team on
- Advisory ID: DRUPAL-SA-CONTRIB-2012-079
- Project: Post Affiliate Pro (third-party module)
- Version: 6.x
- Date: 2012-May-16
- Security risk: Critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting, Access bypass
Update: this module has been fixed (2014-03-21). Please go the project page and download the most current release.
Description
XSS:
CVE: CVE-2012-2706
Access bypass:
CVE: CVE-2012-3802
Post Affiliate Pro (PAP) is a module providing affiliate functionality for Ubercart and Post Affiliate Pro application.
The module doesn't sufficiently filter user supplied text provided by users registering on the site and also allows unauthorized users to view other user's commission.
Versions affected
- All versions of the module.
Drupal core is not affected. If you do not use the contributed Post Affiliate Pro module, there is nothing you need to do.
Solution
The module is no longer supported. Users should disable it. Users interested in continuing to use it should see the project page for more information.
Also see the Post Affiliate Pro project page.
Reported by
Fixed by
No fix was provided.
Coordinated by
- Michael Hess of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
