SA-CONTRIB-2012-101 - Protected Node - Access Bypass

The Protected Node module enables users to use a password to restrict access to an individual node or all nodes of a node type.

The module doesn’t sufficiently protect node access when nodes are accessed outside of the standard node view (i.e. node/1 is protected but other lists are not).

CVE: CVE-2012-2730

Versions affected

• Protected node 6.x-1.x versions prior to 6.x-1.6.

Drupal core is not affected. If you do not use the contributed Protected node module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Protected node module for Drupal 6.x, upgrade to Protected node 6.x-1.6

Also see the Protected node project page.

Reported by

• Martin Barbella

Fixed by

• Alexis Wilke the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Michael Hess of the Drupal Security Team