Date
Severity
Moderately Critical
Vulnerability
Brute Force
Affected versions
<7.x-1.7

Description

The Mother May I module requires visitors to enter a site-specific "secret word" before they can create a new account, in order to block automated spam registrations.

The module doesn't throttle failed secret word attempts: `_mothermayi_user_register_validate()` validated the submitted word on every registration request with no flood control, so an anonymous user could submit the registration form an unlimited number of times to brute-force or dictionary-attack the shared word and defeat the protection.

This vulnerability is mitigated by the fact that an exploit's success depends on the complexity of the configured secret word, and the attack only applies to sites that use this module with open ("visitors") registration.

Solution

Install the latest version.

If you use the Mother May I module for Drupal 7, upgrade to Mother May I 7.x-1.7:


Reported by

Fixed by

Coordinated by

  • Tag1 D7ES