FKIE_CVE-2009-3921

Vulnerability from fkie_nvd - Published: 2009-11-09 17:30 - Updated: 2026-06-16 23:12
Severity
Summary
The Smartqueue_og module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certain circumstances involving subqueue creation, which allows remote authenticated users to discover arbitrary organic group names by reading confirmation messages.
References
cve@mitre.orghttp://drupal.org/node/617496Patch, Vendor Advisory
cve@mitre.orghttp://drupal.org/node/617500Patch, Vendor Advisory
cve@mitre.orghttp://drupal.org/node/623554Patch, Vendor Advisory
cve@mitre.orghttp://osvdb.org/59675
cve@mitre.orghttp://secunia.com/advisories/37288Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/36925Patch
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/617496Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/617500Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/623554Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/59675
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37288Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36925Patch
Impacted products
Vendor Product Version
drupal drupal *
ezra_barnett_gildesgame smartqueue_og 5.x-1.0
ezra_barnett_gildesgame smartqueue_og 5.x-1.1
ezra_barnett_gildesgame smartqueue_og 5.x-1.2
ezra_barnett_gildesgame smartqueue_og 5.x-1.x-dev
ezra_barnett_gildesgame smartqueue_og 6.x-1.0
ezra_barnett_gildesgame smartqueue_og 6.x-1.0
ezra_barnett_gildesgame smartqueue_og 6.x-1.x-dev
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ezra_barnett_gildesgame:smartqueue_og:5.x-1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BC40212-935B-4742-B5F4-0128D4D5691D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ezra_barnett_gildesgame:smartqueue_og:5.x-1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FBC957C-6687-4D78-A3FB-98F3D3DC4CE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ezra_barnett_gildesgame:smartqueue_og:5.x-1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3C40725-FEF7-4E96-A6B7-FB496070AD63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ezra_barnett_gildesgame:smartqueue_og:5.x-1.x-dev:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF93D1D4-2E97-4773-849F-1F0D89BA83E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ezra_barnett_gildesgame:smartqueue_og:6.x-1.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "EF19A274-1AE2-44B9-839B-3EF84DB235F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ezra_barnett_gildesgame:smartqueue_og:6.x-1.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "1F30C62A-DC66-4498-8572-9608D5C137B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ezra_barnett_gildesgame:smartqueue_og:6.x-1.x-dev:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FD0B6B4-7B13-4E7B-B371-13004653FFF1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Smartqueue_og module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certain circumstances involving subqueue creation, which allows remote authenticated users to discover arbitrary organic group names by reading confirmation messages."
    },
    {
      "lang": "es",
      "value": "El m\u00f3dulo Smartqueue_og v5.x anteriores a v5.x-1.3 y v6.x anteriores a6.x-1.0-rc3, m\u00f3dulo para  Drupal, en ciertas circunstancias no verifica los privilegios del nodo de grupo, implicando la creaci\u00f3n de una sub-cola que permite a usuarios remotos autenticados, descubrir nombres de grupo org\u00e1nicos de su elecci\u00f3n leyendo los mensajes de confirmaci\u00f3n."
    }
  ],
  "id": "CVE-2009-3921",
  "lastModified": "2026-06-16T23:12:38.233",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-11-09T17:30:00.953",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/617496"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/617500"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/623554"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/59675"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37288"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/36925"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/617496"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/617500"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/623554"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/59675"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37288"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/36925"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.