PRLP - Critical - Access Bypass and Privilege Escalation

* Advisory ID: DRUPAL-SA-CONTRIB-2017-030
* Project: Password Reset Landing Page (PRLP)
* Version: 8.x
* Date: 2017-March-08
* Security risk: 16/25 ( Critical)
* Vulnerability: Access bypass, Privilege escalation

DESCRIPTION

This module adds a form on the password-reset-landing page to allow changing
the password of the user during the log in process.

The module does not sufficiently validate all access tokens, which allows an
attacker to change the password of any arbitrary user and gain access to
their account.

In order to exploit, the attacker must have an active account on the site.

VERSIONS AFFECTED

* PRLP versions prior to 8.x-1.3

Drupal core is not affected. If you do not use the contributed Password Reset
Landing Page (PRLP) module, there is nothing you need to do.

SOLUTION

Install the latest version:

* If you use the PRLP module for Drupal 8.x, upgrade to PRLP 8.x-1.3
(the latest 8.x release as of this advisory date).

Also see the Password Reset Landing Page (PRLP) project page: https://www.drupal.org/project/prlp

Add new comment