Drupal Association members fund grants that make connections all over the world.
- Advisory ID: DRUPAL-SA-CONTRIB-2013-078
- Project: Quick Tabs (third-party module)
- Version: 6.x, 7.x
- Date: 2013-October-02
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Access bypass
The Quick Tabs module allows you to create blocks of tabbed content, specifically views, blocks, nodes and other quicktabs. You can create a block on your site containing multiple tabs with corresponding content.
The module does not sufficiently check block permissions before rendering a Quick Tab. Before this vulnerability was addressed, if a block had been restricted to only appear for certain roles, that access was not checked before rending it within a Quick Tab - leaving the contents of that block visible to the world.
This vulnerability is mitigated by the fact that node and view permissions are respected, meaning the vulnerability primarily exists for custom blocks created for specific roles.
CVE identifier(s) issued
- Quick Tabs 7.x-3.x versions prior to 7.x-3.6.
- Quick Tabs 6.x-3.x versions prior to 6.x-3.2.
- Quick Tabs 6.x-2.x versions prior to 6.x-2.2.
Drupal core is not affected. If you do not use the contributed Quick Tabs module, there is nothing you need to do.
Install the latest version:
- If you use the Quick Tabs 3.x module for Drupal 7.x, upgrade to Quick Tabs 7.x-3.6
- If you use the Quick Tabs 3.x module for Drupal 6.x, upgrade to Quick Tabs 6.x-3.2
- If you use the Quick Tabs 2.x module for Drupal 6.x, upgrade to Quick Tabs 6.x-2.2
Also see the Quick Tabs project page.
- Lee Rowlands of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.