The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the Who can read data submitted to this webform permission to delete arbitrary submissions via unspecified vectors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Monster_menus | Monster_menus_project | 6.x-6.19 (including) | 6.x-6.19 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.22 (including) | 6.x-6.22 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.23 (including) | 6.x-6.23 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.24 (including) | 6.x-6.24 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.25 (including) | 6.x-6.25 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.26 (including) | 6.x-6.26 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.27 (including) | 6.x-6.27 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.29 (including) | 6.x-6.29 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.30 (including) | 6.x-6.30 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.31 (including) | 6.x-6.31 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.32 (including) | 6.x-6.32 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.33 (including) | 6.x-6.33 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.34 (including) | 6.x-6.34 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.35 (including) | 6.x-6.35 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.36 (including) | 6.x-6.36 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.37 (including) | 6.x-6.37 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.38 (including) | 6.x-6.38 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.41 (including) | 6.x-6.41 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.42 (including) | 6.x-6.42 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.43 (including) | 6.x-6.43 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.44 (including) | 6.x-6.44 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.48 (including) | 6.x-6.48 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.53 (including) | 6.x-6.53 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.56 (including) | 6.x-6.56 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.57 (including) | 6.x-6.57 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.59 (including) | 6.x-6.59 (including) |
| Monster_menus | Monster_menus_project | 6.x-6.60 (including) | 6.x-6.60 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.0 (including) | 7.x-1.0 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.1 (including) | 7.x-1.1 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.2 (including) | 7.x-1.2 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.3 (including) | 7.x-1.3 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.4 (including) | 7.x-1.4 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.5 (including) | 7.x-1.5 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.6 (including) | 7.x-1.6 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.7 (including) | 7.x-1.7 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.8 (including) | 7.x-1.8 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.9 (including) | 7.x-1.9 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.10 (including) | 7.x-1.10 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.11 (including) | 7.x-1.11 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.12 (including) | 7.x-1.12 (including) |
| Monster_menus | Monster_menus_project | 7.x-1.x-dev (including) | 7.x-1.x-dev (including) |
References
- http://secunia.com/advisories/54391
- http://www.openwall.com/lists/oss-security/2013/08/10/1
- http://www.securityfocus.com/bid/61711
- https://drupal.org/node/2059805
- https://drupal.org/node/2059807
- https://drupal.org/node/2059823
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86326
- http://secunia.com/advisories/54391
- http://www.openwall.com/lists/oss-security/2013/08/10/1
- http://www.securityfocus.com/bid/61711
- https://drupal.org/node/2059805
- https://drupal.org/node/2059807
- https://drupal.org/node/2059823
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86326