SA-CONTRIB-2015-068 - Campaign Monitor - Cross Site Request Forgery (CSRF)

Campaign Monitor module integrates the Campaign Monitor API into Drupal.

The module doesn’t sufficiently protect some URLs against CSRF. A malicious user can cause another user to enable and disable list subscriptions by getting their browser to make a request to a specially-crafted URL.

CVE identifier(s) issued

• CVE-2015-4364

Versions affected

• Campaign Monitor 7.x-1.0

Drupal core is not affected. If you do not use the contributed Campaign Monitor module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Campaign Monitor module 7.x-1.0, upgrade to Campaign Monitor 7.x-1.1

Also see the project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• andrechun
• Christopher Skene

Coordinated by

• Pere Orga of the Drupal Security Team