Prepopulate - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-009

The Prepopulate module allows form fields to be pre-populated in the request.

The Prepopulate module does not adequately prevent a user from overwriting arbitrary parts of $_REQUEST. It also does not prevent pre-populating certain fields that are not displayed or manipulating markup fields to alter elements of the user interface.

CVE identifier(s) issued

• CVE-2016-3187
• CVE-2016-3188

Versions affected

• Prepopulate 7.x-2.x versions prior to 7.x-2.1.

Drupal core is not affected. If you do not use the contributed Prepopulate module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Prepopulate module for Drupal 7.x, upgrade to Prepopulate 7.x-2.1

Also see the Prepopulate project page.

Reported by

• Neil Drumm of the Drupal Security Team

Fixed by

• Joshua Brauer the module maintainer

Coordinated by

• Michael Hess of the Drupal Security Team