Vulnerability in Acquia Commons
CVE-2013-1907
The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.029 (86.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 86.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000
Affected products
- Acquia Commons — versions _group7.x-3.x, 7.x-3.x
- Acquia Commons Group
- Drupal
Weakness classification (CWE)
References
- packetstormsecurity.com/files/120991/Drupal-Common-Groups-7.x-Access-Bypass-Pri…
- seclists.org/fulldisclosure/2013/Mar/242 (mailing-list)
- secunia.com/advisories/52795 (Vendor Advisory, third-party-advisory)
- drupal.org/node/1954764
- secunia.com/advisories/52769 (Vendor Advisory, third-party-advisory)
- drupal.org/node/1954948 (Vendor Advisory)
- drupal.org/node/1954762
- osvdb.org/91748 (vdb-entry)
- exchange.xforce.ibmcloud.com/vulnerabilities/83133 (vdb-entry)