CVE-2015-3404

Vulnerability

The Certify module for Drupal 6.x, versions prior to 6.x-2.3, does not properly perform node access checks when showing and creating PDF certificates [4]. This allows remote authenticated users to bypass intended access restrictions and obtain sensitive PDF certificate information [4]. The vulnerability is present in the 6.x-2.x branch before 6.x-2.3 [3][4].

Exploitation

An attacker must be a remote authenticated user on the Drupal site and must have completed the conditions required for a certificate [4]. The attacker can then view or create PDF certificates for nodes they should not have access to, by exploiting the missing node access checks [4]. No special privileges beyond authentication are required.

Impact

Successful exploitation leads to unauthorized disclosure of PDF certificate information [4]. The attacker gains access to certificates that should be restricted, potentially revealing sensitive data contained in those certificates. The impact is limited to information disclosure; no code execution or privilege escalation is reported.

Mitigation

The fix is included in Certify 6.x-2.3, released on 14 January 2015 [3][4]. Users should upgrade to version 6.x-2.3 immediately. No workarounds are mentioned in the references. The module is for Drupal 6.x, which is itself end-of-life, but the module fix addresses this specific vulnerability.