CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS
Percentile
99.7%
The Quick Tabs module allows you to create blocks of tabbed content, specifically views, blocks, nodes and other quicktabs. You can create a block on your site containing multiple tabs with corresponding content.
The module does not sufficiently check block permissions before rendering a Quick Tab. Before this vulnerability was addressed, if a block had been restricted to only appear for certain roles, that access was not checked before rending it within a Quick Tab - leaving the contents of that block visible to the world.
This vulnerability is mitigated by the fact that node and view permissions are respected, meaning the vulnerability primarily exists for custom blocks created for specific roles.
Drupal core is not affected. If you do not use the contributed Quick Tabs module, there is nothing you need to do.
Install the latest version:
Also see the Quick Tabs project page.
drupal.org/contact
drupal.org/project/quicktabs
drupal.org/security-team
drupal.org/security-team/risk-levels
drupal.org/security/secure-configuration
drupal.org/user/153963
drupal.org/user/299097
drupal.org/user/395439
drupal.org/user/847318
drupal.org/writing-secure-code
drupal.org/node/2103113
drupal.org/node/2103121
drupal.org/node/2103127