Description
The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html ↗
- http://seclists.org/fulldisclosure/2013/Mar/244 ↗
- https://drupal.org/node/1954768 ↗
- http://secunia.com/advisories/52795 ↗
- https://drupal.org/node/1954766 ↗
- http://secunia.com/advisories/52766 ↗
- https://drupal.org/node/1954948 ↗
- http://osvdb.org/91747 ↗