CVE-2014-9504 Missing authorization in n/a
Remote attackers can access child groups in Drupal Open Atrium due to improper membership inheritance in the OG Subgroups module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-9504?
CVE-2014-9504 is a high-severity missing authorization vulnerability in n/a, published on 1 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance.
Weakness: CWE-284
Which versions are affected by CVE-2014-9504?
It affects 1 product.
Products include Open Atrium Project Open Atrium.
How do I fix CVE-2014-9504?
No fix has been published for CVE-2014-9504 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-9504 being exploited?
There is no known exploitation of CVE-2014-9504 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hg4v-rxmf-r8x5.