CVE-2014-9503

The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2018-02-01

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Open Atrium (Open Atrium Project)

References

• http://www.openwall.com/lists/oss-security/2015/01/04/6
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99656
• https://www.drupal.org/node/2394979
• https://www.drupal.org/node/2395045