Entityform Block - Moderately Critical - Access Bypass - SA-CONTRIB-2015-106

This module enables you to display an entityform as a block.

The module doesn’t sufficiently check permissions on the entityform under scenarios where the form is locked to a certain role.

CVE identifier(s) issued

• CVE-2015-5493

Versions affected

• Entityform Block 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Entityform block module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Entityform Block module for Drupal 7.x, upgrade to Entityform Block 7.x-1.3

Also see the Entityform block project page.

Reported by

• Niels de Feyter

Fixed by

• Tim Whitney the module maintainer

Coordinated by

• Rick Manelius of the Drupal Security Team
• Aaron Ott Provisional member of the Drupal Security Team