Drupal OG Vocabulary Module Security Bypass Vulnerability

Bugtraq ID:	52042
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 15 2012 12:00AM
Updated:	Feb 15 2012 12:00AM
Credit:	Chris Czeyka
Vulnerable:	Drupal OG Vocabulary 6.X-1.1
Not Vulnerable:	Drupal OG Vocabulary 6.X-1.2

Drupal OG Vocabulary Module Security Bypass Vulnerability

The OG Vocabulary module for Drupal is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

OG Vocabulary versions 6.x-1.x through 6.x-1.2 are vulnerable.

Drupal OG Vocabulary Module Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Drupal OG Vocabulary Module Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.

Drupal OG Vocabulary Module Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2012-021 - Organic Groups Vocab Access Bypass (Drupal)