Project
Import CSV Data
Date
Severity
Moderately Critical
Risk Score
14/25 AC:None/A:None/CI:Some/II:None/E:Proof/TD:Uncommon
Vulnerability
Access Bypass
Affected versions
<7.x-3.1

Description

The Import CSV Data module lets administrators upload CSV files that are imported into dedicated database tables, and it provides an aggregate report block that displays the contents of those imported tables.

The module does not perform any access check before building the aggregate report block, so the imported CSV data and the table selection filter are returned to whoever can view the block, including anonymous visitors, rather than being restricted to a trusted permission.

This vulnerability is mitigated by the fact that the report block is not placed in any region by default, so a site administrator must place the block before the imported data becomes reachable.

Solution

Install the latest version.

If you use the Import CSV Data module for Drupal 7, upgrade to Import CSV Data 7.x-3.1:

Reported by

Fixed by

  • Tag1 D7ES

Coordinated by

  • Tag1 D7ES