SA-CONTRIB-2013-089 - Node Access Keys - Access Bypass

Node Access Keys helps to grant users temporary view permissions to selected content types on a per user role basis. However, it only implements hook_node_access() and not hook_query_alter(), which means any listing of nodes does not respect the node view access.

CVE identifier(s) issued

• CVE-2013-4596

Versions affected

• Node Access Keys 7.x-1.0.

Drupal core is not affected. If you do not use the contributed Node Access Keys module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Node Access Keys module for Drupal 7.x, upgrade to Node Access Keys 7.x-1.1

Also see the Node Access Keys project page.

Reported by

• Daniel Korte the module maintainer

Fixed by

• Daniel Korte the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team