Keyword Research - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-098

Keyword Research module enables you to tag and prioritize keywords on a site and node level basis.

The module doesn’t sufficiently protect some URLs against CSRF. A malicious user can cause another user with “kwresearch admin site keywords” permission to create, delete and set priorities to keywords by getting their browser to make a request to a specially-crafted URL.

CVE identifier(s) issued

• CVE-2015-4396

Versions affected

• Keyword Research 6.x-1.x versions prior to 6.x-1.2.

Drupal core is not affected. If you do not use the contributed Keyword Research module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Keyword Research module for Drupal 6.x, upgrade to Keyword Research 6.x-1.2

Also see the Keyword Research project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• Tom McCracken the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team