CVE-2014-9503 The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging impr...
MediumCVSS 6.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open atrium project open atrium | >= 7.x-2.0, < 7.x-2.26 | 7.x-2.26 |
| open atrium project open atrium | = 7.x-2.0-alpha1 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha2 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha3 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha4 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha5 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta1 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta2 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta3 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta4 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-rc1 | No fix listed |
References
- [oss-security] 20150103 Re: CVE requests: Drupal contributed modules issue-tracking mailing-list third-party-advisory
- openatrium-drupal-cve20149503-sec-bypass(99656) third-party-advisory vdb-entry
- www.drupal.org mitigation vendor-advisory
- www.drupal.org patch vendor-advisory