Webform Multiple File Upload - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-083

Webform Multiple File Upload module enables you to upload multiple files at once in webforms.

The module doesn’t sufficiently protect some URLs against CSRF. A malicious user can cause a user with edit access to webforms to delete files by getting their browser to make a request to a specially-crafted URL.

CVE identifier(s) issued

• CVE-2015-4379

Versions affected

• Webform Multiple File Upload 6.x-1.x versions prior to 6.x-1.3.
• Webform Multiple File Upload 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Webform Multiple File Upload module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Webform Multiple File Upload module for Drupal 6.x, upgrade to Webform Multiple File Upload 6.x-1.3
• If you use the Webform Multiple File Upload module for Drupal 7.x, upgrade to Webform Multiple File Upload 7.x-1.3

Also see the Webform Multiple File Upload project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• Jelle Sebreghts the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team