PT-2013-6254 · Drupal · Og Features Module

Published 2013-12-19 · Updated 2017-08-29 · CVE-2013-7067

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OG Features module versions 6.x-1.x before 6.x-1.4 for Drupal

Description The issue allows remote attackers to bypass intended access restrictions. This is due to the OG Features module not properly overriding pages that have an access callback set to false, enabling attackers to access restricted areas via a request.

Recommendations For OG Features module versions 6.x-1.x before 6.x-1.4, update to version 6.x-1.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-7067

Affected Products

Og Features Module

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-7067 · Security Note
• https://drupal.org/node/2149791 · Vendor Advisory
• https://drupal.org/node/2149743 · Patch
• http://osvdb.org/100611 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89458 · Note
• http://securityfocus.com/bid/64134 · Note