CVE-2013-1908

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-07-16 · updated 2026-06-16
Weakness: CWE-264

Description

The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.

Affected products

Acquia Commons: through 7.x-3.0; 7.x-3.x-dev
Commons Wikis Project Commons Wikis: through 7.x-3.0; 7.x-3.x-dev

References

http://osvdb.org/91747
http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2013/Mar/244
http://secunia.com/advisories/52766
http://secunia.com/advisories/52795
https://drupal.org/node/1954766
https://drupal.org/node/1954768
https://drupal.org/node/1954948
http://osvdb.org/91747
http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2013/Mar/244
http://secunia.com/advisories/52766

Get alerted when CVE-2013-1908 or the next vulnerability affects your stack