SA-CONTRIB-2012-151 - Commerce Extra Panes - Cross Site Request Forgery

This module, an add-on for Drupal Commerce, allows site builders to place one or more nodes in one of the checkout phases of an order.

The module doesn’t sufficiently confirm the intent of a site builder when taking certain administrative operations. This could allow an attacker to trick an administrator into unknowingly enabling/disabling a Commerce extra panes pane.

CVE: CVE-2012-5542

Versions affected

• Commerce extra panes 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Commerce extra panes module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Commerce extra panes module for Drupal 7.x, upgrade to Commerce extra panes 7.x-1.1

Also see the Commerce extra panes project page.

Reported by

• Ivo Van Geertruyen of the Drupal Security Team

Fixed by

• Ivo Van Geertruyen of the Drupal Security Team
• Pedro Cambra the Module Maintainer

Coordinated by

• Ivo Van Geertruyen of the Drupal Security Team