CVE-2014-9504 The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance.
HighCVSS 7.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open atrium project open atrium | >= 7.x-2.0, < 7.x-2.26 | 7.x-2.26 |
| open atrium project open atrium | = 7.x-2.0-alpha1 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha2 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha3 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha4 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-alpha5 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta1 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta2 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta3 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-beta4 | No fix listed |
| open atrium project open atrium | = 7.x-2.0-rc1 | No fix listed |
References
- [oss-security] 20150103 Re: CVE requests: Drupal contributed modules issue-tracking mailing-list
- openatrium-drupal-cve20149504-sec-bypass(99657) third-party-advisory vdb-entry
- www.drupal.org mitigation vendor-advisory
- www.drupal.org patch vendor-advisory