Description
The Mother May I module requires visitors to enter a site-specific "secret word" before they can create a new account, in order to block automated spam registrations.
The module doesn't throttle failed secret word attempts: `_mothermayi_user_register_validate()` validated the submitted word on every registration request with no flood control, so an anonymous user could submit the registration form an unlimited number of times to brute-force or dictionary-attack the shared word and defeat the protection.
This vulnerability is mitigated by the fact that an exploit's success depends on the complexity of the configured secret word, and the attack only applies to sites that use this module with open ("visitors") registration.
Solution
Install the latest version.
If you use the Mother May I module for Drupal 7, upgrade to Mother May I 7.x-1.7:
Reported by
Fixed by
Coordinated by
- Tag1 D7ES