SA-CONTRIB-2013-091 - Groups, Communities and Co (GCC) - Access Bypass

This module enables you to manage groups and assign content and users to groups.
The module doesn’t sufficiently check permissions to some of the configuration pages allowing unprivileged users to access the roles and permissions pages of the GCC module.

CVE identifier(s) issued

• CVE-2013-4598

Versions affected

• GCC 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Groups, Communities and Co (GCC) module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the GCC module for Drupal 7.x, upgrade to GCC 7.x-1.1.

Also see the Groups, Communities and Co (GCC) project page.

Reported by

• Jean Jacques Ancel

Fixed by

• Edouard Fajnzilberg the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team