5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.004 Low
EPSS
Percentile
72.5%
This module enables you to enable and disable bundles of functionality for individual Organic groups. In order to provide this functionality, this module must override all menu callbacks available in the system, in order to delegate access based on the current Organic group you are contextually in, and the settings of the features for that group.
The module doesn’t sufficiently override pages that have an access callback explicitly set to FALSE, which indicates that no user (even admins) are able to access the page. Since this module does not handle that condition correctly, users will have access to those pages.
This vulnerability is mitigated by the fact that it’s extremely rare that a page in Drupal has it’s access callback explicitly set to FALSE because that would mean that no single user, including admins, would be able to access the page.
Drupal core is not affected. If you do not use the contributed OG Features module, there is nothing you need to do.
Install the latest version:
Also see the OG Features project page.
drupal.org/contact
drupal.org/project/og
drupal.org/project/og_features
drupal.org/security-team
drupal.org/security-team/risk-levels
drupal.org/security/secure-configuration
drupal.org/writing-secure-code
drupal.org/node/2149743
drupal.org/user/105111
drupal.org/user/107190
drupal.org/user/169459
drupal.org/user/36762