CVE-2013-4228 Missing authorization in Organic Groups (OG) module
Authenticated users can bypass access controls to read content from arbitrary private groups in the Drupal Organic Groups module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-4228?
CVE-2013-4228 is a medium-severity missing authorization vulnerability in Organic Groups (OG) module, published on 18 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors.
Weakness: CWE-863
Which versions are affected by CVE-2013-4228?
It affects 1 product.
Products include Organic Groups Project Organic Groups.
How do I fix CVE-2013-4228?
No fix has been published for CVE-2013-4228 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2013-4228 being exploited?
There is no known exploitation of CVE-2013-4228 in the wild and no public exploit code.
Other vulnerabilities in Organic Groups (OG) module
Sources
Also known as GHSA-h4vj-jq9j-frqv.