Vulnerability Details CVE-2013-4228
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 46.1%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
- http://www.openwall.com/lists/oss-security/2013/08/10/1
- http://www.securityfocus.com/bid/61708
- https://drupal.org/node/2059755
- https://drupal.org/node/2059765
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86328
- http://www.openwall.com/lists/oss-security/2013/08/10/1
- http://www.securityfocus.com/bid/61708
- https://drupal.org/node/2059755
- https://drupal.org/node/2059765
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86328
Products affected by CVE-2013-4228
-
cpe:2.3:a:organic_groups_project:organic_groups:7.x-2.0
-
cpe:2.3:a:organic_groups_project:organic_groups:7.x-2.1
-
cpe:2.3:a:organic_groups_project:organic_groups:7.x-2.2