Description
The Login Disable module lets an administrator disable the user login form for everyone and, for added security, gate access to it behind a secret word that must be present as a URL query argument.
The module does not apply any flood control to this check, so an attacker can send an unlimited number of login form requests with different guessed keys without ever being throttled or locked out, making the secret word possible to brute force.
This vulnerability is mitigated by the fact that a correct key only re-enables the login form for display. The attacker must still supply valid credentials and hold the "bypass disabled login" permission to actually complete a login, and the module is uncommon while the access key is an optional feature.
Solution
Install the latest version.
If you use the Login Disable module for Drupal 7, upgrade to Login Disable 7.x-1.4:
Reported by
- Pierre Rudloff (prudloff) of the Drupal Security Team
Fixed by
Coordinated by
- Greg Knaddison (greggles) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Tag1 D7ES