PT-2012-4211 · Drupal · Organic Groups

Kurt Seifried · Published 2012-06-27 · Updated 2017-08-29 · CVE-2012-2721

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Organic Groups (OG) module versions 6.x-2.x before 6.x-2.4

Description The issue arises from improper permission checks in the default views of the Organic Groups (OG) module when all users have the "access content" permission removed. This allows remote attackers to bypass access restrictions, potentially leading to unspecified impacts.

Recommendations For Organic Groups (OG) module versions 6.x-2.x before 6.x-2.4, update to version 6.x-2.4 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-2721

Affected Products

Organic Groups

References · 9

• 🔥 http://drupalcode.org/project/og.git/commitdiff/1485708 · Exploit
• http://drupal.org/node/1619736 · Patch
• http://secunia.com/advisories/49397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2721 · Security Note
• http://drupal.org/node/1619810 · Vendor Advisory
• http://securityfocus.com/bid/53838 · Note
• http://openwall.com/lists/oss-security/2012/06/14/3 · Note
• http://osvdb.org/82728 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76150 · Note