CVE-2013-4228

EUVD-2013-4132
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
Affected Products (NVD)
VendorProductVersion
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.0:x
organic_groups_projectorganic_groups
7.x-2.1:x
organic_groups_projectorganic_groups
7.x-2.2:x
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2013/08/10/1
http://www.securityfocus.com/bid/61708
https://drupal.org/node/2059755
https://drupal.org/node/2059765
https://exchange.xforce.ibmcloud.com/vulnerabilities/86328
http://www.openwall.com/lists/oss-security/2013/08/10/1
http://www.securityfocus.com/bid/61708
https://drupal.org/node/2059755
https://drupal.org/node/2059765
https://exchange.xforce.ibmcloud.com/vulnerabilities/86328