Description
The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated users with the "edit comments" permission to edit arbitrary comments of other users via unspecified vectors.
References
- https://drupal.org/node/2007048
- 20130529 [Security-news] SA-CONTRIB-2013-048 - Edit Limit - Access Bypass mailing-list
- [oss-security] 20130529 Re: CVE request for Drupal contributed modules mailing-list
- https://drupal.org/node/2006188
- drupal-editlimit-cve20132122-security-bypass(84630) vdb-entry
- 93725 vdb-entry
- 60209 vdb-entry
- 53556 third-party-advisory