Voting starts in March for the Drupal Association Board election.
- Advisory ID: DRUPAL-SA-2008-014
- Project: Userpoints (third-party module)
- Version: 4.7.x, 5.x-2.x, 5.x-3.x
- Date: 2008-January-30
- Security risk: Not critical
- Exploitable from: Remote
- Vulnerability: Cross site request forgery
Userpoints is a system for keeping track of points earned on a site. It can be used to reward users for contributions to a community and also for ecommerce transactions.
The Drupal Forms API protects against cross site request forgeries (CSRF), where a malicious site can cause a user to unintentionally submit a form to another site where they are authenticated. The point moderation form does not follow the standard Forms API submission model and is therefore not protected against this type of attack. A CSRF attack may result in the acceptance or decline of points which were in moderation.
- Userpoints for Drupal 4.7.x before Userpoints 4.7.x-2.3
- Userpoints for Drupal 5.x before Userpoints 5.x-3.3 or 5.x-2.16
Drupal core is not affected. If you do not use the contributed Userpoints module, there is nothing you need to do.
Install the latest version:
- If you currently use Userpoints 4.7.x-2.x upgrade to Userpoints 4.7.x-2.3.
- If you currently use Userpoints 5.x-2.x upgrade to Userpoints 5.x-2.16.
- If you currently use Userpoints 5.x-3.x upgrade to Userpoints 5.x-3.3.
See also the User points project page.
Greg Knaddison (greggles) of the Drupal Security Team.
The security contact for Drupal can be reached via email at security at drupal.org or via the form at http://drupal.org/contact.