Cloud - Critical - CSRF - SA-CONTRIB-2017-086

Project: Cloud
Version: 7.x-1.x-dev
Date: 2017-November-29
Security risk: *Critical* 18∕25
Vulnerability: CSRF

Description

This module enables sites to manage public clouds like Amazon EC2 and also
private clouds like OpenStack.

The module doesn't sufficiently protect the deletion of audit reports,
thereby exposing a cross-site request vulnerability which can be exploited by
unprivileged users to trick an administrator into unwanted deletion of audit
reports.

This vulnerability is mitigated by the fact that the victim must have a role
with the permission "access audit report".

Solution

Install the latest version:

* If you use the Cloud module for Drupal 7, upgrade to Cloud 7.x-1.7

Add new comment