First published: Tue Apr 29 2014(Updated: )
The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group restrictions on nodes with all groups set to optional input via an empty group field.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Organic Groups Project Organic Groups | =7.x-2.0 | |
Organic Groups Project Organic Groups | =7.x-2.0-alpha1 | |
Organic Groups Project Organic Groups | =7.x-2.0-alpha2 | |
Organic Groups Project Organic Groups | =7.x-2.0-alpha3 | |
Organic Groups Project Organic Groups | =7.x-2.0-beta1 | |
Organic Groups Project Organic Groups | =7.x-2.0-beta2 | |
Organic Groups Project Organic Groups | =7.x-2.0-beta3 | |
Organic Groups Project Organic Groups | =7.x-2.0-beta4 | |
Organic Groups Project Organic Groups | =7.x-2.0-rc1 | |
Organic Groups Project Organic Groups | =7.x-2.0-rc2 | |
Organic Groups Project Organic Groups | =7.x-2.0-rc3 | |
Organic Groups Project Organic Groups | =7.x-2.0-rc4 | |
Organic Groups Project Organic Groups | =7.x-2.1 | |
Organic Groups Project Organic Groups | =7.x-2.2 | |
Organic Groups Project Organic Groups | =7.x-2.x-dev |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-7068 has a moderate severity level allowing unauthorized access to nodes.
To mitigate CVE-2013-7068, you should upgrade the Organic Groups module to version 7.x-2.3 or higher.
CVE-2013-7068 affects users of the Organic Groups module versions 7.x-2.0 to 7.x-2.2 for Drupal.
CVE-2013-7068 enables remote authenticated users to bypass group restrictions on certain nodes.
Failing to address CVE-2013-7068 may lead to unauthorized access and potential exposure of sensitive content within user groups.