SA-CONTRIB-2012-166 - Table of Contents - Access Bypass

This module enables you to generates a list of select header tags in a box that looks like a table of contents or summary. The links added to that box point to the headers so users can quickly access each section of your documents.

The module doesn’t sufficiently check for node access restrictions when displaying the table of contents in a block.

This vulnerability is mitigated by the fact that an attacker must find a node that is not visible to him/her and yet displays its blocks including the table of contents block. In some Drupal installations, this can happen for unpublished nodes. Also, the attacker will only see the headers (content between H1 to H6 tags) appearing in the table of contents, not the entire page.

CVE: CVE-2012-5584

Versions affected

• tableofcontents 6.x-3.x versions prior to 6.x-3.8.

Drupal core is not affected. If you do not use the contributed Table of Contents module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the table of contents module for Drupal 6.x, upgrade to tableofcontents 6.x-3.8

Also see the Table of Contents project page.

Reported by

• Erik Webb

Fixed by

• Erik Webb the reporter
• Alexis Wilke the Drupal 6.x maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team