I got this news today about SA-CORE-2014-005 - Drupal core - SQL injection.
We are not using drupal in build authentication. We have a custom authentication, which resides behind SSO and gateway. A user can only get access or even get access page if the user is the in SSO and Gateway servers.
Is this kind of setting also vulnerable to this attack, as access is not handled by drupal?