The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote authenticated users with the “access administration pages” permission to change module settings via unspecified vectors.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8734
Reference (s):
- https://www.drupal.org/node/2365259
- https://www.drupal.org/node/2365685
- XF:drupal-ogmenu-access-bypass(98445)
- URL: https://exchange.xforce.ibmcloud.com/vulnerabilities/98445