SA-CONTRIB-2012-059 - Autosave - Cross Site Request Forgery

CVE: CVE-2012-2097

This module enables snapshots of your node edit form to be saved in the background while you are editing to help prevent the data from being lost.

The module doesn’t sufficiently protect against a user being tricked into submitting saved results to a node.

Versions affected

• Autosave 6.x versions prior to 6.x-2.10

Drupal core is not affected. If you do not use the contributed Autosave module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Autosave module for Drupal 6.x, upgrade to Autosave 6.x-2.10

Also see the Autosave project page.

Reported by

• Ryan Jud Hughes

Fixed by

• liquidcms the module maintainer
• Crell the module maintainer

Coordinated by

• Michael Hess of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team