Drupal

Open Atrium – Moderately critical – Information Disclosure – SA-CONTRIB-2014-041

Leave a comment

Description

Open Atrium is a distribution the enables collaboration sites to be built. It contains several custom modules to provide various functionality. While content is often protected behind private groups, public content can also be shared. When using Open Atrium as an internal Intranet, this “public” content might be restricted to only logged in users by disabling anonymous access to the site.

The oa_core and oa_comment modules do not properly respect the “view published content” permission and allows anonymous users to view this “public” content regardless of the permission setting.

This only affects sites that have disabled the “view published content” permission for anonymous users, and only affects a small number of views.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Open Atrium distribution 7.x-2.x versions prior to 7.x-2.615
  • oa_core 7.x-2.x versions prior to 7.x-2.84.
  • oa_comment 7.x-2.x versions prior to 7.x-2.14.

Drupal core is not affected. If you do not use the contributed Open Atrium Core module, there is nothing you need to do.

Solution

Install the latest version of Open Atrium. Be sure to revert the following features:
oa_comments, oa_core, oa_news, oa_river, oa_section, oa_sections

Also see the Open Atrium project page.

Reported by

Fixed by

  • Mike Potter the distribution maintainer and member of the Drupal Security Team

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 
Drupal 7.x

Leave a Reply