SA-CONTRIB-2012-087 - Comment Moderation - Cross Site Request Forgery

This module enables you to moderate comments in an accelerated way, by providing a complete interface and all useful actions in a unique page.
The module doesn’t sufficiently protect the publish link URL, thus a Cross Site Request Forgery (CSRF) attack against an administrator could result in unintended publishing of comments.

CVE: CVE-2012-2716

Versions affected

• Comment Moderation 6.x-1.x versions prior to 6.x-1.1.

Drupal core is not affected. If you do not use the contributed Comment Moderation module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Comment Moderation module for Drupal 6.x, upgrade to Comment Moderation 6.x-1.1

Also see the Comment Moderation project page.

Reported by

• Dylan Tack (grendzy) of the Drupal Security Team
• Tim Wood (timwood)

Fixed by

• David Stosik, one of the module maintainers

Coordinated by

• Members of the Drupal Security Team