Improper access control

2018-02-0117:29:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

51.6%

JSON

The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with “access content” permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks.

CPENameOperatorVersion
open_atriumeq>= 7.x2.0 AND < 7.x2.26
open_atriumeq7.x-2.0 alpha2
open_atriumeq7.x-2.0 alpha1
open_atriumeq7.x-2.0 alpha3
open_atriumeq7.x-2.0 alpha4
open_atriumeq7.x-2.0 alpha5
open_atriumeq7.x-2.0 beta1
open_atriumeq7.x-2.0 beta2
open_atriumeq7.x-2.0 beta3
open_atriumeq7.x-2.0 beta4

Name	Operator	Version
open_atrium	eq	>= 7.x2.0 AND < 7.x2.26
open_atrium	eq	7.x-2.0 alpha2
open_atrium	eq	7.x-2.0 alpha1
open_atrium	eq	7.x-2.0 alpha3
open_atrium	eq	7.x-2.0 alpha4
open_atrium	eq	7.x-2.0 alpha5
open_atrium	eq	7.x-2.0 beta1
open_atrium	eq	7.x-2.0 beta2
open_atrium	eq	7.x-2.0 beta3
open_atrium	eq	7.x-2.0 beta4