Description
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors.
References
- 64729 vdb-entry
- drupal-entityapi-cve20141398-security-bypass(90215) vdb-entry
- FEDORA-2014-0508 vendor-advisory
- FEDORA-2014-0509 vendor-advisory
- [oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1050802
- https://www.drupal.org/node/2169595