PT-2009-6142 · Drupal · Smartqueue Og

Publicado 2009-11-09 · Atualizado 2009-11-10 · CVE-2009-3921

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Smartqueue og module versions 5.x before 5.x-1.3 Smartqueue og module versions 6.x before 6.x-1.0-rc3

Description The issue concerns the Smartqueue og module for Drupal, where it fails to verify group-node privileges in certain situations involving subqueue creation. This allows remote authenticated users to discover arbitrary organic group names by reading confirmation messages.

Recommendations For Smartqueue og module versions 5.x before 5.x-1.3, update to version 5.x-1.3 or later. For Smartqueue og module versions 6.x before 6.x-1.0-rc3, update to version 6.x-1.0-rc3 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-3921

Produtos afetados

Smartqueue Og

Referências · 7

• http://secunia.com/advisories/37288 · Aviso do Fabricante
• http://drupal.org/node/617496 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3921 · Nota de Segurança
• http://drupal.org/node/617500 · Aviso do Fabricante
• http://drupal.org/node/623554 · Aviso do Fabricante
• http://osvdb.org/59675 · Nota
• http://securityfocus.com/bid/36925 · Correção