SA-CONTRIB-2013-054 - Fast Permissions Administration - Access Bypass

The Fast Permissions Administration module enables you to use inline filters on the permissions page, as well as loading the permissions form through a modal dialog.

The module doesn’t sufficiently check user access for the modal content callback, allowing unauthorized access to the permissions edit form.

CVE identifier(s) issued

• CVE-2013-2247

Versions affected

• Fast Permissions Administration 6.x-2.x versions prior to 6.x-2.5.
• Fast Permissions Administration 7.x-2.x versions prior to 7.x-2.3.

Drupal core is not affected. If you do not use the contributed Fast Permissions Administration module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Fast Permissions Administration module for Drupal 6.x, upgrade to Fast Permissions Administration 6.x-2.5
• If you use the Fast Permissions Administration module for Drupal 7.x, upgrade to Fast Permissions Administration 7.x-2.3

Also see the Fast Permissions Administration project page.

Reported by

• Philip Boden

Fixed by

• Corey Aufang the module maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team