Description
The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which allows remote attackers to bypass intended access restrictions via a request.
References
- https://drupal.org/node/2149743
- https://drupal.org/node/2149791
- 100611 vdb-entry
- 64134 vdb-entry
- ogfeatures-overridepages-security-bypass(89458) vdb-entry