Description
The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors.
References
- 64729 vdb-entry
- FEDORA-2014-0508 vendor-advisory
- FEDORA-2014-0509 vendor-advisory
- drupal-entity-cve20141400-sec-bypass(90396) vdb-entry
- [oss-security] 20140109 Re: CVE Request: drupal7-entity: multiple access bypass vulnerabilities mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1050802
- https://www.drupal.org/node/2169595