SA-CONTRIB-2012-148 - OG - Access Bypass

OG (Organic groups) enables users to create and manage their own ‘groups’. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. A group membership can be given immediately upon subscribing, or be pending - waiting for a group administrator to approve it.

OG doesn’t properly maintain pending memberships if the user is allowed to edit their own account.

In addition, under certain circumstances, a user was able to post to a group which they were not a member of.

There are no additional mitigating factors for these issues.

CVE: CVE-2012-5539

Versions affected

• OG (Organic groups) 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Organic groups module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the OG 7.x-1.x module for Drupal 7.x, upgrade to OG (Organic groups) 7.x-1.5

Also see the Organic groups project page.

Reported by

• Zoltán Tóth
• John Takousis

Fixed by

• Amitai Burstein the module maintainer

Coordinated by

• Lee Rowlands
• Greg Knaddison of the Drupal Security Team