SA-CONTRIB-2012-021 - Organic Groups Vocab Access Bypass

CVE: CVE-2012-1644

This module enables you to have a specific vocabulary per organic group.
The module doesn’t sufficiently check access to vocabularies while allowing a group admin to edit the vocabularies.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to “administer own group vocabulary” and be an admin of another group.

Versions affected

• OG Vocab 6.x-1.x versions prior to 6.x-1.2.

Drupal core is not affected. If you do not use the contributed OG Vocabulary module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the OG Vocab module for Drupal 6.x, upgrade to OG Vocab 6.x-1.2

See also the OG Vocabulary project page.

Reported by

• Chris Czeyka

Fixed by

• Amitai Burstein the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team