- Advisory ID: DRUPAL-SA-CONTRIB-2017-072
- Project: Clientside Validation (third-party module)
- Version: 7.x
- Date: 2017-September-06
- Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All
- Vulnerability: Arbitrary PHP code execution
The module does not sufficiently validate parameters of a POST request made when validating a CAPTCHA.
For the 1.x version of this module, this vulnerability is mitigated by the fact that the CAPTCHA module must be enabled and the 'validate captcha' option of the Clientside Validation module must be enabled (this option is enabled by default).
For the 2.x version of this module, this vulnerability is mitigated by the fact that the CAPTCHA module must be enabled and the Clientside Validation captcha submodule must be enabled.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
- Clientside Validation 7.x-1.x versions prior to 7.x-1.44.
- Clientside Validation 7.x-2.x versions prior to 7.x-2.0-beta1.
Drupal core is not affected. If you do not use the contributed Clientside Validation module, there is nothing you need to do.
Install the latest version:
- If you use the 1.x version of Clientside Validation module for Drupal 7.x, upgrade to Clientside Validation 7.x-1.45
- If you use the 2.x version of Clientside Validation module for Drupal 7.x, upgrade to Clientside Validation 7.x-2.0-beta2
Also see the Clientside Validation project page.
- Jelle Sebreghts the module maintainer
- Greg Knaddison of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Drupal version: Drupal 7.x