By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2013-078
  • Project: Quick Tabs (third-party module)
  • Version: 6.x, 7.x
  • Date: 2013-October-02
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass

Description

The Quick Tabs module allows you to create blocks of tabbed content, specifically views, blocks, nodes and other quicktabs. You can create a block on your site containing multiple tabs with corresponding content.

The module does not sufficiently check block permissions before rendering a Quick Tab. Before this vulnerability was addressed, if a block had been restricted to only appear for certain roles, that access was not checked before rending it within a Quick Tab - leaving the contents of that block visible to the world.

This vulnerability is mitigated by the fact that node and view permissions are respected, meaning the vulnerability primarily exists for custom blocks created for specific roles.

CVE identifier(s) issued

  • CVE-2013-4406

Versions affected

  • Quick Tabs 7.x-3.x versions prior to 7.x-3.6.
  • Quick Tabs 6.x-3.x versions prior to 6.x-3.2.
  • Quick Tabs 6.x-2.x versions prior to 6.x-2.2.

Drupal core is not affected. If you do not use the contributed Quick Tabs module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Quick Tabs project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x, Drupal 7.x