CVE-2013-4406
UnknownEPSS 1.51%
Last modified
CVE-2013-4406 is a vulnerability of currently unknown severity. The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block permissions, which allows remote attackers to obtain sensitive information by reading a Quick Tab.. EPSS estimates a 1.51% chance of exploitation in the next 30 days.
Description
The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block permissions, which allows remote attackers to obtain sensitive information by reading a Quick Tab.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Quick Tabs Module Project | Quicktabs | 6.x-3.0 | — |
| Quick Tabs Module Project | Quicktabs | 6.x-3.1 | — |
| Quick Tabs Module Project | Quicktabs | 6.x-3.x | Dev |
| Quick Tabs Module Project | Quicktabs | 7.x-3.0 | — |
| Quick Tabs Module Project | Quicktabs | 7.x-3.1 | — |
| Quick Tabs Module Project | Quicktabs | 7.x-3.2 | — |
| Quick Tabs Module Project | Quicktabs | 7.x-3.3 | — |
| Quick Tabs Module Project | Quicktabs | 7.x-3.4 | — |
| Quick Tabs Module Project | Quicktabs | 7.x-3.5 | — |
| Quick Tabs Module Project | Quicktabs | 7.x-3.x | Dev |
| Quick Tabs Module Project | Quicktabs | 6.x-2.0 | — |
| Quick Tabs Module Project | Quicktabs | 6.x-2.1 | — |
| Quick Tabs Module Project | Quicktabs | 6.x-2.x | Dev |
References
- https://drupal.org/node/2103187Patch, Vendor Advisory
- https://drupal.org/node/2103187Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-4406?
The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block permissions, which allows remote attackers to obtain sensitive information by reading a Quick Tab.
How severe is CVE-2013-4406?
Severity scoring for CVE-2013-4406 is pending analysis. The EPSS model estimates a 1.51% probability of exploitation in the next 30 days.
How do I fix CVE-2013-4406?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-4400virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local…
- CVE-2013-4401The virConnectDomainXMLToNative API function in libvirt 1.1.…
- CVE-2013-4402The compressed packet parser in GnuPG 1.4.x before 1.4.15 an…
- CVE-2013-4403Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2013-4404cumin in Red Hat Enterprise MRG Grid 2.4 does not properly e…
- CVE-2013-4405Multiple cross-site request forgery (CSRF) vulnerabilities i…
- CVE-2013-4407HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07…
- CVE-2013-4408Heap-based buffer overflow in the dcerpc_read_ncacn_packet_d…
- CVE-2013-4409An eval() vulnerability exists in Python Software Foundation…9.8
- CVE-2013-4410ReviewBoard: has an access-control problem in REST API7.5
- CVE-2013-4411Review Board: URL processing gives unauthorized users access…4.3
- CVE-2013-4412slim has NULL pointer dereference when using crypt() method …7.5
Are you affected by CVE-2013-4406?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST