OSVDB ID: 86163

Title: Basic webmail Module for Drupal Permission Weakness User Email Disclosure

Info

Disclosure

Oct 10, 2012

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Oct 10, 2012

Description

Basic webmail Module for Drupal contains a flaw that may lead to an unauthorized information disclosure. This issue is triggered when the application allows a remote attacker with the access basic_webmail permission to gain access to the email addresses of other users on the site.

Classification

Location: Remote / Network Access
Impact: Loss of Confidentiality
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified
OSVDB: Web Related

Solution

Upgrade to version 6.x-1.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Jason Flatt

Basic webmail Module for Drupal

6.x-1.1
6.x-1.0

References

Credit

Unknown or Incomplete



Direct URL: http://osvdb.org/86163