CVE-2014-1398
First published: Thu Jan 09 2014(Updated: )
The entity module for Drupal was recently reported to be affected by multiple access bypass vulnerabilites, which could be exploited by an attacker to gain unauthorized access to the data. 1) Comment, User and Node Statistics property access bypass The module's entity wrapper access API doesn't sufficiently protect comment, user and node statistics properties from unprivileged user access. This vulnerability is mitigated by the fact that a module must be enabled that relies on the Entity property access API and it must be configured to expose either comment, user or node statistics properties. One example would be the RESTful Web Services module (RESTWS) with the permission configured to access the comment, user or node resource for untrusted web service consumers. 2) Entity list property access bypass The module's entity wrapper access API doesn't sufficiently check entity access on referenced entities such as taxonomy terms. This vulnerability is mitigated by the fact that a module must be enabled that uses the access() method of entity metadata wrappers to determine access to a property which references multiple entities to which access is not granted. One example would be the RESTful Web Services module (RESTWS) with respectively configured permissions on an entity property or (entity reference) field, for example a list of (unaccessible) referenced user entities on a node entity. 3) Unpublished comments access bypass The module's entity_access() API doesn't protect unpublished comments from being viewed by unprivileged users. This vulnerability is mitigated by the fact a module must be enabled which uses the provided entity access API on comments and the comment module must be enabled. The issues are said to be fixed in drupal7-entity-1.3. References: <a href="https://drupal.org/node/2169595">https://drupal.org/node/2169595</a> <a href="http://packetstormsecurity.com/files/124728/DRUPAL-SA-CONTRIB-2014-001.txt">http://packetstormsecurity.com/files/124728/DRUPAL-SA-CONTRIB-2014-001.txt</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/drupal7-entity | <1.3 | 1.3 |
| Entity API for Drupal | =7.x-1.0 | |
| Entity API for Drupal | =7.x-1.1 | |
| Entity API for Drupal | =7.x-1.2 | |
| Fedora | =19 | |
| Fedora | =20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://drupal.org/node/2169595
- http://packetstormsecurity.com/files/124728/DRUPAL-SA-CONTRIB-2014-001.txt
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1050803
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1050804
- http://seclists.org/oss-sec/2014/q1/55
- https://bugzilla.redhat.com/show_bug.cgi?id=1050802
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html
- http://www.openwall.com/lists/oss-security/2014/01/09/3
- http://www.securityfocus.com/bid/64729
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90215
- https://www.drupal.org/node/2169595
Frequently Asked Questions
What is the severity of CVE-2014-1398?
CVE-2014-1398 is categorized as a critical vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2014-1398?
To fix CVE-2014-1398, upgrade the affected Entity API for Drupal to version 7.x-1.3 or later.
What systems are affected by CVE-2014-1398?
CVE-2014-1398 affects Drupal installations using Entity API versions 7.x-1.0, 7.x-1.1, and 7.x-1.2.
What types of access does CVE-2014-1398 allow?
CVE-2014-1398 allows attackers to bypass access control and gain unauthorized access to Comment, User, and Node Statistics properties.
When was CVE-2014-1398 disclosed?
CVE-2014-1398 was disclosed in 2014, highlighting serious security implications for Drupal users utilizing affected versions.
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-1398
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/entity api project
- canonical/entity api for drupal
- version/entity api for drupal/7.x-1.0
- version/entity api for drupal/7.x-1.1
- version/entity api for drupal/7.x-1.2
- vendor/fedoraproject
- canonical/fedora
- version/fedora/19
- version/fedora/20