[Security-news] Open Atrium - Moderately critical - Information Disclosure - SA-CONTRIB-2014-041

[security-news at drupal.org]

View online: https://www.drupal.org/node/2869156

   * Advisory ID: DRUPAL-SA-CONTRIB-2014-041
   * Project: Open Atrium Core [1]     (third-party module), OA Comment [2]
     (third-party module)
   * Version: 7.x
   * Date: 2017-April-12
   * Security risk: 11/25 ( Moderately Critical)
     AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [3]
   * Vulnerability: Information Disclosure

-------- DESCRIPTION
---------------------------------------------------------

Open Atrium is a distribution the enables collaboration sites to be built.
It contains several custom modules to provide various functionality.  While
content is often protected behind private groups, public content can also be
shared.  When using Open Atrium as an internal Intranet, this "public"
content might be restricted to only logged in users by disabling anonymous
access to the site.

The oa_core and oa_comment modules do not properly respect the "view
published content" permission and allows anonymous users to view this
"public" content regardless of the permission setting.

This only affects sites that have disabled the "view published content"
permission for anonymous users, and only affects a small number of views.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [4] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Open Atrium distribution 7.x-2.x versions prior to 7.x-2.615
   * oa_core 7.x-2.x versions prior to 7.x-2.84.
   * oa_comment 7.x-2.x versions prior to 7.x-2.14.

Drupal core is not affected. If you do not use the contributed Open Atrium
Core [5] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version of Open Atrium.  Be sure to revert the following
features:
oa_comments, oa_core, oa_news, oa_river, oa_section, oa_sections

Also see the Open Atrium [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Mike Potter [7] of the Drupal Security Team

-------- FIXED BY
------------------------------------------------------------

   * Mike Potter [8] the distribution maintainer and member of the Drupal
     Security Team

-------- COORDINATED BY
------------------------------------------------------

   * Mike Potter [9] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and  securing your site [13].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [14]


[1] https://www.drupal.org/project/oa_core
[2] https://www.drupal.org/project/oa_comment
[3] https://www.drupal.org/security-team/risk-levels
[4] http://cve.mitre.org/
[5] https://www.drupal.org/project/oa_core
[6] https://www.drupal.org/project/openatrium
[7] https://www.drupal.org/u/mpotter
[8] https://www.drupal.org/u/mpotter
[9] https://www.drupal.org/u/mpotter
[10] https://www.drupal.org/contact
[11] https://www.drupal.org/security-team
[12] https://www.drupal.org/writing-secure-code
[13] https://www.drupal.org/security/secure-configuration
[14] https://twitter.com/drupalsecurity