SA-CONTRIB-2014-111 - Protected Pages - Password Protection Bypass

Protected Pages modules allows the administrator to secure any page in your website by password by configuring a add path and the associated password.

The module did not sufficiently protect variations on the protected path.

CVE identifier(s) issued

• CVE-2014-9024

Versions affected

• Protected Pages 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Protected Pages module,
there is nothing you need to do.

Solution

Install the latest version:

• Upgrade to protected_pages 7.x-2.4

Also see the Protected Pages project page.

Reported by

• Olaf Grabienski

Fixed by

• Varun Mishra the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Michael Hess of the Drupal Security Team