Cloud - Critical - CSRF - SA-CONTRIB-2017-086

Project: Cloud
Version: 7.x-1.x-dev
Date: 2017-November-29
Security risk: *Critical* 18∕25
Vulnerability: CSRF


This module enables sites to manage public clouds like Amazon EC2 and also
private clouds like OpenStack.

The module doesn't sufficiently protect the deletion of audit reports,
thereby exposing a cross-site request vulnerability which can be exploited by
unprivileged users to trick an administrator into unwanted deletion of audit

This vulnerability is mitigated by the fact that the victim must have a role
with the permission "access audit report".


Install the latest version:

* If you use the Cloud module for Drupal 7, upgrade to Cloud 7.x-1.7

Add new comment