CVE-2013-4228

4.3 mediumEPSS 1.2%

Medium (4.3) in organic groups project organic groups. EPSS 1.2% chance of exploitation in the next 30 days.

The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2020-02-18
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

organic_groups_project:organic_groups

References

http://www.openwall.com/lists/oss-security/2013/08/10/1
http://www.securityfocus.com/bid/61708
https://drupal.org/node/2059755
https://drupal.org/node/2059765
https://exchange.xforce.ibmcloud.com/vulnerabilities/86328

Check your stack JSON