CVE-2012-2721 The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote...
MediumCVSS 6.8
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote attackers to bypass access restrictions and possibly have other unspecified impact.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| moshe weitzman organic groups | = 6.x-2.0 | No fix listed |
| moshe weitzman organic groups | = 6.x-2.0-rc1 | No fix listed |
| moshe weitzman organic groups | = 6.x-2.0-rc2 | No fix listed |
| moshe weitzman organic groups | = 6.x-2.0-rc3 | No fix listed |
| moshe weitzman organic groups | = 6.x-2.1 | No fix listed |
| moshe weitzman organic groups | = 6.x-2.2 | No fix listed |
| moshe weitzman organic groups | = 6.x-2.3 | No fix listed |
| moshe weitzman organic groups | = 6.x-2.x-dev | No fix listed |
References
- drupal.org patch
- drupal.org patch vendor-advisory
- drupalcode.org exploit patch
- 49397 third-party-advisory vendor-advisory
- [oss-security] 20120613 Re: CVE Request for Drupal contributed modules mailing-list
- 82728 vdb-entry
- 53838 vdb-entry
- organicgroups-permission-security-bypass(76150) vdb-entry