[Security-news] SA-CONTRIB-2009-071 - Organic Groups Vocabulary Access Bypass

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2009-071
  * Project: OG Vocabulary (third party module)
  * Version: 6.x
  * Date: 2009-October-14
  * Security risk: Critical
  * Exploitable from: Remote
  * Vulnerability: Access bypass

.... Description

The Organic Groups Vocabulary module enables an organic group to have a group
specific vocabulary. A vulnerability in this module allows any group member,
even if they are not a group admin, to view, edit, and create vocabularies
and terms for all groups.
.... Versions affected

  * Organic Groups Vocabulary module versions 6.x prior to 6.x-1.0

Drupal core is not affected. If you do not use the contributed Organic Groups
Vocabulary module, there is nothing you need to do.
.... Solution

Install the latest version.
  * Organic Groups Vocabulary module for Drupal 6.x upgrade to Organic Groups
    Vocabulary module 6.x-1.0 [1]

.... Reported by

FGM [2] and Ki [3]
.... Fixed by

mrag_28 [4] and Amitaibu [5], the module maintainer.
-------- CONTACT  
-------------------------------------------------------------

The security team for Drupal can be reached at security at drupal.org or via
the form at http://drupal.org/contact.

[1] http://drupal.org/node/604354
[2] http://drupal.org/user/27985
[3] http://drupal.org/user/292047
[4] http://drupal.org/user/206162
[5] http://drupal.org/user/57511