Drupal Organic Groups Vocabulary Module Unauthorized Access Vulnerability

Bugtraq ID:	36685
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 14 2009 12:00AM
Updated:	Oct 16 2009 07:48PM
Credit:	FGM and Ki
Vulnerable:	Drupal Organic Groups Vocabulary 6.x-beta
Not Vulnerable:	Drupal Organic Groups Vocabulary 6.x-1.0

Drupal Organic Groups Vocabulary Module Unauthorized Access Vulnerability

The Drupal Organic Groups Vocabulary module is prone to an unauthorized-access vulnerability because it fails to adequately enforce access permissions.

An attacker can exploit this vulnerability to gain unauthorized access to the application; other attacks may also possible.

Versions prior to Organic Groups Vocabulary 6.x-1.0 are vulnerable.

Drupal Organic Groups Vocabulary Module Unauthorized Access Vulnerability

Attackers may exploit this issue via a browser.

Drupal Organic Groups Vocabulary Module Unauthorized Access Vulnerability

Solution:
Updates are available. Please see the references for details.

Drupal Organic Groups Vocabulary Module Unauthorized Access Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-071 - Organic Groups Vocabulary Access Bypass (Drupal)