CVEvulnerability
CVE-2013-4228
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-02-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-863
Description
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors.
Affected configurations
• organic groups project organic groups 7.x-2.0
• organic groups project organic groups 7.x-2.1
• organic groups project organic groups 7.x-2.2
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- http://www.openwall.com/lists/oss-security/2013/08/10/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/61708 Third Party Advisory, VDB Entry
- https://drupal.org/node/2059755 Release Notes, Vendor Advisory
- https://drupal.org/node/2059765 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86328 VDB Entry, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2013/08/10/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/61708 Third Party Advisory, VDB Entry
- https://drupal.org/node/2059755 Release Notes, Vendor Advisory
- https://drupal.org/node/2059765 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86328 VDB Entry, Vendor Advisory