Information disclosure vulnerability in Drupal's Realname User Reference
Widget contributed module (version 6.x-1.0)
Discovered by Martin Barbella <[email protected]>
Drupal is a free software package that allows an individual or a
community of users to easily publish, manage and organize a wide variety
of content on a website (http://drupal.org/about).
The Realname CCK User Reference Widget module adds a new widget to the
User Reference CCK field type that uses the Realnames for autocompletion
(http://drupal.org/project/realname_userreference).
Only the access content permission is needed to access the page which
displays the user names and real names for users, used by the
autocompletion widget, resulting in an information disclosure
vulnerability.
This has been confirmed in version 6.x-1.0 of the Realname User
Reference Widget module.
This would allow an attacker to collect user names for brute force
attacks, or real names of users for targeted phishing.
A user must have the access content permission to exploit this
vulnerability, though in most cases even anonymous users would have this
permission.
2010-02-01 - Drupal Security notified
2010-02-16 - Still no response from Drupal Security
2010-02-16 - Public disclosure