CVE-2013-1908 - OpenCVE

The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Acquia	Commons
Commons Wikis Project	Commons Wikis
Drupal	Drupal

Configuration 1 [-]

AND

OR	cpe:2.3:a:acquia:commons::::::::
	cpe:2.3:a:acquia:commons:7.x-3.x:dev::::::
	cpe:2.3:a:commons_wikis_project:commons_wikis::::::::
	cpe:2.3:a:commons_wikis_project:commons_wikis:7.x-3.x:dev::::::

cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/91747
http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2013/Mar/244
http://secunia.com/advisories/52766
http://secunia.com/advisories/52795
https://drupal.org/node/1954766
https://drupal.org/node/1954768
https://drupal.org/node/1954948

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2013-07-16T18:00:00Z

Updated: 2024-09-16T22:02:29.866Z

Reserved: 2013-02-19T00:00:00Z

Link: CVE-2013-1908

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2013-07-16T18:55:01.257

Modified: 2013-07-17T04:00:00.000

Link: CVE-2013-1908

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-07-16T18:00:00Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html"}, {"name": "20130327 [Security-news] SA-CONTRIB-2013-039 - Commons Wikis - Access bypass & Privilege escalation", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2013/Mar/244"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://drupal.org/node/1954768"}, {"name": "52795", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/52795"}, {"tags": ["x_refsource_MISC"], "url": "https://drupal.org/node/1954766"}, {"name": "52766", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/52766"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://drupal.org/node/1954948"}, {"name": "91747", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/91747"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2013-1908", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html"}, {"name": "20130327 [Security-news] SA-CONTRIB-2013-039 - Commons Wikis - Access bypass & Privilege escalation", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2013/Mar/244"}, {"name": "https://drupal.org/node/1954768", "refsource": "CONFIRM", "url": "https://drupal.org/node/1954768"}, {"name": "52795", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/52795"}, {"name": "https://drupal.org/node/1954766", "refsource": "MISC", "url": "https://drupal.org/node/1954766"}, {"name": "52766", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/52766"}, {"name": "https://drupal.org/node/1954948", "refsource": "CONFIRM", "url": "https://drupal.org/node/1954948"}, {"name": "91747", "refsource": "OSVDB", "url": "http://osvdb.org/91747"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T15:20:37.016Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html"}, {"name": "20130327 [Security-news] SA-CONTRIB-2013-039 - Commons Wikis - Access bypass & Privilege escalation", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2013/Mar/244"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://drupal.org/node/1954768"}, {"name": "52795", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/52795"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://drupal.org/node/1954766"}, {"name": "52766", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/52766"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://drupal.org/node/1954948"}, {"name": "91747", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/91747"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-1908", "datePublished": "2013-07-16T18:00:00Z", "dateReserved": "2013-02-19T00:00:00Z", "dateUpdated": "2024-09-16T22:02:29.866Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:acquia:commons:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF5614CE-043D-4579-BA4E-4729D2CD22F9", "versionEndIncluding": "7.x-3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:acquia:commons:7.x-3.x:dev:*:*:*:*:*:*", "matchCriteriaId": "4FA305F0-248F-4A7A-9EB2-F11043BCD919", "vulnerable": true}, {"criteria": "cpe:2.3:a:commons_wikis_project:commons_wikis:*:*:*:*:*:*:*:*", "matchCriteriaId": "1723C3C9-9B6D-47BA-B363-2A966594A88B", "versionEndIncluding": "7.x-3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:commons_wikis_project:commons_wikis:7.x-3.x:dev:*:*:*:*:*:*", "matchCriteriaId": "13EC7687-5D3E-490F-8B8F-17C450FA0370", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors."}, {"lang": "es", "value": "El m\u00f3dulo Commons Wikis anterior a v7.x-3.1 para Drupal, como se utiliza en el m\u00f3dulo Commons anterior a v7.x-3.1, no restringe correctamente el acceso a grupos, lo que permite a ataques remotos poner contenido arbitrario a grupos mediante vectores no especificados."}], "id": "CVE-2013-1908", "lastModified": "2013-07-17T04:00:00.000", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-07-16T18:55:01.257", "references": [{"source": "secalert@redhat.com", "url": "http://osvdb.org/91747"}, {"source": "secalert@redhat.com", "url": "http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html"}, {"source": "secalert@redhat.com", "url": "http://seclists.org/fulldisclosure/2013/Mar/244"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/52766"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/52795"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://drupal.org/node/1954766"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "https://drupal.org/node/1954768"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "https://drupal.org/node/1954948"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}