SA-CONTRIB-2012-065 - Sitedoc - Information disclosure

CVE: CVE-2012-2302

This module enables you to display a plethora of information about your site’s structure. Optionally, the information may be saved into a file for later comparison.

The module doesn’t sufficiently verify that the saved file is protected by the Private File System.

This vulnerability is mitigated by the fact that the administrator must have configured the module to save the HTML report file to disk.

Versions affected

• Sitedoc 6.x-1.x versions prior to 6.x-1.4.

Drupal core is not affected. If you do not use the contributed Site Documentation module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Sitedoc module for Drupal 6.x, upgrade to Sitedoc 6.x-1.4, and
• Enable the private file system if you want to save the output file.

Also see the Site Documentation project page.

Reported by

• Jakub Suchý of the Drupal Security Team

Fixed by

• Nancy Wichmann, the module maintainer

Coordinated by

• Forest Monsen of the Drupal Security Team