Chat Room - Moderately Critical - Access Bypass - SA-CONTRIB-2015-169

Chat Room enables site owners to integrate chats into nodes by adding the chat room field to them. The module relies on a websocket connection to send chat messages to the client.

The module doesn’t sufficiently validate access before setting up the websocket. As a result, users may receive messages from chat rooms they don’t have access to via the websocket.

CVE identifier(s) issued

• CVE-2015-8601

Versions affected

• Chat Room 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Chat Room module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Chat Room module for Drupal 7.x, upgrade to Chat Room 7.x-2.2

Also see the Chat Room project page.

Reported by

• Gergely Lekli

Fixed by

• Gergely Lekli

Coordinated by

• Greg Knaddison of the Drupal Security Team