SA-CONTRIB-2013-002 - Payment - Access Bypass

Payment enables other modules to make payments using a variety of payment processing services.

The module incorrectly grants access when checking if a user can view payments, allowing a user to access the payments of other users.

CVE identifier(s) issued

• CVE-2013-0182

Versions affected

• Payment 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Payment module, there is nothing you need to do.

Solution

Update to Payment 7.x-1.3 or later.

Also see the Payment project page.

Reported by

• Dario Emmanuel Godoy Rojas

Fixed by

• Bart Feenstra (the module maintainer)

Coordinated by

• Greg Knaddison of the Drupal Security Team