Clientside Validation - Critical - Arbitrary PHP Execution - DRUPAL-SA-CONTRIB-2017-072

* Advisory ID: DRUPAL-SA-CONTRIB-2017-072
* Project: Clientside Validation (third-party module)
* Version: 7.x
* Date: 2017-September-06
* Security risk: 16/25 ( Critical)
* Vulnerability: Arbitrary PHP code execution

DESCRIPTION

The Clientside Validation module enables you to have clientside (Javascript)
validation on your forms.

The module does not sufficiently validate parameters of a POST request made
when validating a CAPTCHA.

For the 1.x version of this module, this vulnerability is mitigated by the
fact that the CAPTCHA module must be enabled and the 'validate captcha'
option of the Clientside Validation module must be enabled (this option is
enabled by default).

For the 2.x version of this module, this vulnerability is mitigated by the
fact that the CAPTCHA module must be enabled and the Clientside Validation
captcha submodule must be enabled.

VERSIONS AFFECTED

* Clientside Validation 7.x-1.x versions prior to 7.x-1.44.
* Clientside Validation 7.x-2.x versions prior to 7.x-2.0-beta1.

Drupal core is not affected. If you do not use the contributed Clientside
Validation module, there is nothing you need to do.

SOLUTION

Install the latest version:

* If you use the 1.x version of Clientside Validation module for Drupal 7.x, upgrade to Clientside Validation 7.x-1.45 [5]
* If you use the 2.x version of Clientside Validation module for Drupal 7.x, upgrade to Clientside Validation 7.x-2.0-beta2 [6]

Also see the Clientside Validation project page: https://www.drupal.org/project/clientside_validation

Add new comment