----------------------------------------------------------------------


Proof-of-Concept (PoC) and Extended Analysis available for customers.

Get a free trial, contact sales@secunia.com


----------------------------------------------------------------------

TITLE:
Drupal Decisions Module Information Disclosure Security Issue

SECUNIA ADVISORY ID:
SA39561

VERIFY ADVISORY:
http://secunia.com/advisories/39561/

DESCRIPTION:
A security issue has been reported in the Decisions module for
Drupal, which can be exploited by malicious users to disclose
potentially sensitive information.

The security issue exists due to improper access restrictions in the
"Most recent decisions" block in respect to "Domain Access" rules and
can be exploited to view the "last decision" block.

Successful exploitation requires that node restriction is configured
for the domain.

The security issue is reported in versions prior to 5.x-1.2 and prior
to 6.x-1.7.

SOLUTION:
Update to version 5.x-1.2 or 6.x-1.7 or later.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Kirill Stealth.

ORIGINAL ADVISORY:
SA-CONTRIB-2010-037:
http://drupal.org/node/784446

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------