PT-2015-6571 · Drupal · Drupal Open Graph Importer

Pere Orga · Published 2015-06-15 · Updated 2016-06-09 · CVE-2015-4389

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Open Graph Importer (og tag importer) versions 7.x-1.x

Description The issue concerns the Open Graph Importer module for Drupal, which fails to properly check the create permission for content types created during import. This allows remote authenticated users to bypass intended restrictions by leveraging the "import og tag importer" permission.

Recommendations For Drupal Open Graph Importer (og tag importer) versions 7.x-1.x, consider restricting the "import og tag importer" permission to trusted users until a patch is available. As a temporary workaround, review and manually verify the permissions for all content types created during import to ensure they align with intended access controls.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-4389

Affected Products

Drupal Open Graph Importer

References · 4

• https://drupal.org/node/2463891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4389 · Security Note
• http://openwall.com/lists/oss-security/2015/04/25/6 · Note
• http://securityfocus.com/bid/74354 · Note