Information disclosure in Open Atrium Project

CVE-2014-8736

The Open Atrium Core module for Drupal before 7.x-2.22 allows remote attackers to bypass access restrictions and read file attachments that have been removed from a node by leveraging a previous revision of the node.

Vulnerability class: Information Disclosure

EPSS: 0.012 (65.3th percentile) — read the EPSS interpretation.

Affected products

Open_atrium_project Open_atrium
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Patch)