Description
The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges.
References
- 49400 third-party-advisory
- http://drupal.org/node/1618476
- 82727 vdb-entry
- 53840 vdb-entry
- [oss-security] 20120613 Re: CVE Request for Drupal contributed modules mailing-list
- tokenauth-usersession-security-bypass(76141) vdb-entry
- http://drupal.org/node/1619808