CVE-2013-4498: Florian Weber Spaces

Low severity, CVSS 2.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete organic group group spaces content when using the option to move to a new group, which causes the content to be "orphaned" and allows remote authenticated users with the "access content" permission to obtain sensitive information via vectors involving a rebuild access for the site or content.

Affected products

• Florian Weber Spaces: version 6.x-3.0 only; version 6.x-3.1 only; version 6.x-3.2 only; version 6.x-3.3 only; version 6.x-3.4 only; version 6.x-3.5 only; …

Published 2014-05-17. Last modified 2026-06-16.