Description
The Make Meeting Scheduler module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to bypass intended access restrictions for a poll via a direct request to the node's URL instead of the hashed URL.
References
- https://drupal.org/node/2081637
- https://drupal.org/node/2081647
- 54634 third-party-advisory
- [oss-security] 20130927 Re: CVE request for Drupal contributed modules mailing-list