Drupal Smartqueue OG Confirmation Message Security Bypass Vulnerability

Bugtraq ID:	36925
Class:	Access Validation Error
CVE:	CVE-2009-3921
Remote:	Yes
Local:	No
Published:	Nov 04 2009 12:00AM
Updated:	Apr 13 2015 09:06PM
Credit:	Ezra Barnett Gildesgame
Vulnerable:	Drupal Smartqueues OG 6.x-1.0-rc2 Drupal Smartqueues OG 5.x-1.2
Not Vulnerable:	Drupal Smartqueues OG 6.x-1.0-rc3 Drupal Smartqueues OG 5.x-1.3

Drupal Smartqueue OG Confirmation Message Security Bypass Vulnerability

The Smartqueue OG module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

Drupal Smartqueue OG Confirmation Message Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Drupal Smartqueue OG Confirmation Message Security Bypass Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for details.


Drupal Smartqueues OG 5.x-1.2

• Drupal smartqueue_og-5.x-1.3.tar.gz
  http://ftp.drupal.org/files/projects/smartqueue_og-5.x-1.3.tar.gz

Drupal Smartqueues OG 6.x-1.0-rc2

• Drupal smartqueue_og-6.x-1.0-rc3.tar.gz
  http://ftp.drupal.org/files/projects/smartqueue_og-6.x-1.0-rc3.tar.gz

Drupal Smartqueue OG Confirmation Message Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-095 - Smartqueue OG - Access Bypass (Drupal)