[IT-SecNots] [Security-news] Domain Integration - Moderately critical - Access bypass - SA-CONTRIB-2017-084

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2017-084

Project: Domain Integration [1]
Version: 7.x-1.x-dev
Date: 2017-November-29
Security risk: *Moderately critical* 13∕25
AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Description: 
This module enables you to integrate the Domain module with other popular
Drupal modules. The Domain Integration Login Restrict sub-module enables you
to restrict access to a domain based on the assigned domains on a user.

The Domain Integration Login Restrict sub-module doesn't sufficiently check
these restrictions when using one-time logins.

This vulnerability is mitigated by the fact that an attacker must have an
active account on one of the domains.

Solution: 
Install the latest version:

  * If you use the Domain Integration module for Drupal 7.x, upgrade to 
Domain
    Integration 7.x-1.2 [3]

Reported By: 
  * Dominique Climenti [4]

Fixed By: 
  * Dominique Climenti [5]
  * Len Swaneveld [6] the module maintainer
  * Niels de Feyter [7] the module maintainer
  * David Rothstein [8] of the Drupal Security Team
  * Michael Hess [9] of the Drupal Security Team

Coordinated By: 
  * David Rothstein [10] of the Drupal Security Team


[1] https://www.drupal.org/project/domain_integration
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/domain_integration/releases/7.x-1.2
[4] https://www.drupal.org/user/3549871
[5] https://www.drupal.org/user/3549871
[6] https://www.drupal.org/user/690914
[7] https://www.drupal.org/user/599438
[8] https://www.drupal.org/user/124982
[9] https://www.drupal.org/user/102818
[10] https://www.drupal.org/user/124982

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news