- Advisory ID: DRUPAL-SA-CONTRIB-2016-050
- Project: Flag (third-party module)
- Version: 7.x
- Date: 2016-August-31
- Security risk: 12/25 ( Moderately Critical) AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default
- Vulnerability: Information Disclosure
Description
Flag enables users to mark content with any number of admin-defined flags, such as ‘bookmarks’ or ‘spam’. Flag Bookmark is a submodule within Flag, which provides a ‘bookmarks’ flag, and default views to list bookmarked content.
The provided view that lists each user’s bookmarked content as a tab on their user profile has for its access control the permission to use the ‘bookmarks’ flag. This means that any user who has permission to use the ‘bookmarks’ flag can see the list of content that any user has bookmarked.
This vulnerability is mitigated by the fact that the site must have enabled the Flag Bookmark module to create this view, and an attacker must have a role with the permission “Flag node entities as bookmarks”.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- Flag 7.x-3.x versions prior to 7.x-3.8.
Drupal core is not affected. If you do not use the contributed Flag module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Flag module for Drupal 7.x, upgrade to Flag 7.x-3.8
If you have Flag Bookmark enabled, or have enabled it in the past and still have the flag_bookmarks_tab view active, edit this and change the User: uid contextual filter’s as follows:
- set the validator to ‘Current user ID matches argument value’
- set the action to take if the filter value does not validate to ‘Show “Page not found”‘.
Also see the Flag project page.
Reported by
Fixed by
- Joachim Noreiko, the module maintainer
- Dave Long
Coordinated by
- Lee Rowlands of the Drupal Security Team
- Michael Hess of the Drupal Security Team
- Mori Sugimoto of the Drupal Security Team
- Rick Manelius of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity