* Advisory ID: DRUPAL-SA-CONTRIB-2014-041
* Project: Open Atrium Core (third-party module), OA Comment (third-party module)
* Version: 7.x
* Date: 2017-April-12
* Security risk: 11/25 ( Moderately Critical)
* Vulnerability: Information Disclosure
Open Atrium is a distribution the enables collaboration sites to be built.
It contains several custom modules to provide various functionality. While
content is often protected behind private groups, public content can also be
shared. When using Open Atrium as an internal Intranet, this "public"
content might be restricted to only logged in users by disabling anonymous
access to the site.
The oa_core and oa_comment modules do not properly respect the "view
published content" permission and allows anonymous users to view this
"public" content regardless of the permission setting.
This only affects sites that have disabled the "view published content"
permission for anonymous users, and only affects a small number of views.
* Open Atrium distribution 7.x-2.x versions prior to 7.x-2.615
* oa_core 7.x-2.x versions prior to 7.x-2.84.
* oa_comment 7.x-2.x versions prior to 7.x-2.14.
Drupal core is not affected. If you do not use the contributed Open Atrium
Core module, there is nothing you need to do.
Install the latest version of Open Atrium. Be sure to revert the following
oa_comments, oa_core, oa_news, oa_river, oa_section, oa_sections
Also see the Open Atrium project page: https://www.drupal.org/project/openatrium