View online: https://www.drupal.org/node/2869156
* Advisory ID: DRUPAL-SA-CONTRIB-2014-041 * Project: Open Atrium Core [1] (third-party module), OA Comment [2] (third-party module) * Version: 7.x * Date: 2017-April-12 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [3] * Vulnerability: Information Disclosure
-------- DESCRIPTION ---------------------------------------------------------
Open Atrium is a distribution the enables collaboration sites to be built. It contains several custom modules to provide various functionality. While content is often protected behind private groups, public content can also be shared. When using Open Atrium as an internal Intranet, this "public" content might be restricted to only logged in users by disabling anonymous access to the site.
The oa_core and oa_comment modules do not properly respect the "view published content" permission and allows anonymous users to view this "public" content regardless of the permission setting.
This only affects sites that have disabled the "view published content" permission for anonymous users, and only affects a small number of views.
-------- CVE IDENTIFIER(S) ISSUED --------------------------------------------
* /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./
-------- VERSIONS AFFECTED ---------------------------------------------------
* Open Atrium distribution 7.x-2.x versions prior to 7.x-2.615 * oa_core 7.x-2.x versions prior to 7.x-2.84. * oa_comment 7.x-2.x versions prior to 7.x-2.14.
Drupal core is not affected. If you do not use the contributed Open Atrium Core [5] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version of Open Atrium. Be sure to revert the following features: oa_comments, oa_core, oa_news, oa_river, oa_section, oa_sections
Also see the Open Atrium [6] project page.
-------- REPORTED BY ---------------------------------------------------------
* Mike Potter [7] of the Drupal Security Team
-------- FIXED BY ------------------------------------------------------------
* Mike Potter [8] the distribution maintainer and member of the Drupal Security Team
-------- COORDINATED BY ------------------------------------------------------
* Mike Potter [9] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10].
Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13].
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14]
[1] https://www.drupal.org/project/oa_core [2] https://www.drupal.org/project/oa_comment [3] https://www.drupal.org/security-team/risk-levels [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/oa_core [6] https://www.drupal.org/project/openatrium [7] https://www.drupal.org/u/mpotter [8] https://www.drupal.org/u/mpotter [9] https://www.drupal.org/u/mpotter [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity