CVE-2014-9504

HIGH

Open Atrium 7.x-2.0-7.x-2.25 - Improper Access Control in OG Subgroups Module

Title source: llm

Description

The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance.

References (4)

Core 4

Core References

Issue Tracking, Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2015/01/04/6

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/99657

Mitigation, Vendor Advisory x_refsource_misc

https://www.drupal.org/node/2394979

Patch, Vendor Advisory x_refsource_confirm

https://www.drupal.org/node/2395045

Scores

CVSS v3 7.5

EPSS 0.0164

EPSS Percentile 73.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-284

Status published

Products (2)

open_atrium_project/open_atrium 7.x-2.0 alpha1 (10 CPE variants)

open_atrium_project/open_atrium 7.x-2.0 - 7.x-2.26

Published Feb 01, 2018

Tracked Since Feb 18, 2026