SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF)

The Contact Form Fields module enables you to create additional fields to site-wide contact form.

Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the administrator’s browser to make a request to a specially-crafted URL while the administrator was logged in.

CVE identifier(s) issued

• CVE-2015-3363

Versions affected

• All Contact Form Fields versions prior to 6.x-2.3.

Drupal core is not affected. If you do not use the contributed Contact form fields module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Contact Form Fields module for Drupal 6.x, upgrade to Contact Form Fields 6.x-2.3

Also see the Contact form fields project page.

Reported by

• Pere Orga provisional member of the Drupal Security Team

Fixed by

• Timofey Denisov the module maintainer

Coordinated by

• Pere Orga provisional member of the Drupal Security Team