SA-CONTRIB-2015-068 - Campaign Monitor - Cross Site Request Forgery (CSRF)

• Advisory ID: DRUPAL-SA-CONTRIB-2015-068
• Project: Campaign Monitor (third-party module)
• Version: 7.x
• Date: 2015-March-04
• Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
• Vulnerability: Cross Site Request Forgery

Description

Campaign Monitor module integrates the Campaign Monitor API into Drupal.

The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause another user to enable and disable list subscriptions by getting their browser to make a request to a specially-crafted URL.

CVE identifier(s) issued

• CVE-2015-4364

Versions affected

• Campaign Monitor 7.x-1.0

Drupal core is not affected. If you do not use the contributed Campaign Monitor module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Campaign Monitor module 7.x-1.0, upgrade to Campaign Monitor 7.x-1.1

Also see the project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• andrechun
• Christopher Skene

Coordinated by

• Pere Orga of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Edits to this advisory since publishing

Edited on March 15, 2015.