Drupal Open Atrium Core Module Access Security Bypass Vulnerability

Bugtraq ID:	71065
Class:	Access Validation Error
CVE:	CVE-2014-8736
Remote:	Yes
Local:	No
Published:	Oct 15 2014 12:00AM
Updated:	Oct 15 2014 12:00AM
Credit:	.John
Vulnerable:	Drupal Open Atrium 7.x-2.21
Not Vulnerable:	Drupal Open Atrium 7.x-2.22

Drupal Open Atrium Core Module Access Security Bypass Vulnerability

The Open Atrium Core module for Drupal is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized access; this may aid in launching further attacks.

Open Atrium Core 7.x-2.x versions prior to 7.x-2.22 are vulnerable.

Drupal Open Atrium Core Module Access Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Drupal Open Atrium Core Module Access Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Open Atrium Core Module Access Security Bypass Vulnerability

References:

• oa_core 7.x-2.22 Download Page (Drupal)
  
• Open Atrium Home Page (Drupal)
  
• SA-CONTRIB-2014-099 - Open Atrium Core - Access bypass (Drupal)