CVE-2013-4552

Name of the Vulnerable Software and Affected Versions drupalauth module versions prior to 1.2.2

Description The issue allows remote attackers to authenticate as an arbitrary user via the uid in a cookie. This is due to a flaw in the lib/Auth/Source/External.php file of the drupalauth module for simpleSAMLphp.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the uid variable in cookies until the issue is resolved.