CVE-2014-9502 Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote attackers to hijack the authentication o...
HighCVSS 8.8
EPSS 0.93%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote attackers to hijack the authentication of unknown victims via vectors related to menu callbacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open atrium project open atrium | >= 7.x-2.0, < 7.x-2.26 | 7.x-2.26 |
| open atrium project open atrium | = 7.x-2.0-alpha1 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha2 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha3 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha4 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha5 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta1 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta2 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta3 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta4 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-rc1 | No fix listed |
References
- [oss-security] 20150103 Re: CVE requests: Drupal contributed modules issue-tracking mailing-list third-party-advisory
- openatrium-drupal-cve20149502-csrf(99655) third-party-advisory vdb-entry
- www.drupal.org mitigation vendor-advisory
- www.drupal.org patch vendor-advisory