- Advisory ID: DRUPAL-SA-CONTRIB-2014-013
- Project: Chaos tool suite (ctools) (third-party module)
- Version: 6.x, 7.x
- Date: 2014-02-12
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Access bypass
This module provides content editors with an autocomplete callback for entity titles, as well as an ability to embed content within the Chaos tool suite (ctools) framework.
Prior to this version, ctools did not sufficiently check access grants for various types of content other than nodes. It also didn't sufficiently check access before displaying content with the relationship plugin.
These vulnerabilities are mitigated by the fact that you must be using entities other than node or users for the autocomplete callback, or you must be using the relationship plugin and displaying the content (e.g. in panels).
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
- Chaos tool suite (ctools) 6.x-1.x versions prior to 6.x-1.11.
- Chaos tool suite (ctools) 7.x-1.x versions prior to 7.x-1.4.
Drupal core is not affected. If you do not use the contributed Chaos tool suite (ctools) module, there is nothing you need to do.
Install the latest version:
- If you use the Chaos tool suite module for Drupal 6.x, upgrade to ctools 6.x-1.11
- If you use the Chaos tool suite module for Drupal 7.x, upgrade to ctools 7.x-1.4
Also see the Chaos tool suite (ctools) project page.
- Peter Wolanin of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity