Open Social - Critical - Insecure Session Management - SA-CONTRIB-2019-075

Project: Open SocialDate: 2019-November-06Security risk: Critical 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Insecure Session ManagementDescription: Open Social is a Drupal distribution for online communities. The included social_magic_login module doesn't sufficiently validate magic login URLs for user accounts that do not have a local password, but login via external systems. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account.
This vulnerability is mitigated by the fact the module social_magic_login needs to be enabled.Solution: Install the latest version:

Alternatively, disable the module social_magic_login.
Also see the Open Social project page.Reported By: 

  • Heine of the Drupal Security Team

Fixed By: 

Coordinated By: 

  • Heine of the Drupal Security Team
Path to article