CVE-2009-3921

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

The Smartqueue_og module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certain circumstances involving subqueue creation, which allows remote authenticated users to discover arbitrary organic group names by reading confirmation messages.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/617496Patch, Vendor Advisory
http://drupal.org/node/617500Patch, Vendor Advisory
http://drupal.org/node/623554Patch, Vendor Advisory
http://osvdb.org/59675
http://secunia.com/advisories/37288Vendor Advisory
http://www.securityfocus.com/bid/36925Patch
http://drupal.org/node/617496Patch, Vendor Advisory
http://drupal.org/node/617500Patch, Vendor Advisory
http://drupal.org/node/623554Patch, Vendor Advisory
http://osvdb.org/59675
http://secunia.com/advisories/37288Vendor Advisory
http://www.securityfocus.com/bid/36925Patch

Timeline

Published: Nov 9, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-39226.8Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module fo CVE-2009-39237.5The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows re CVE-2009-39249.3Buffer overflow in pbsv.dll, as used in Soldier of Fortune II and possibly other applications when Even Balance PunkBuster 1.728 or earlier CVE-2009-39309.3Multiple integer overflows in Christos Zoulas file before 5.02 allow user-assisted remote attackers to have an unspecified impact via a malf CVE-2009-39319.3Incomplete blacklist vulnerability in browser/download/download_exe.cc in Google Chrome before 3.0.195.32 allows remote attackers to force t CVE-2009-39329.3The Gears plugin in Google Chrome before 3.0.195.32 allows user-assisted remote attackers to cause a denial of service (memory corruption an CVE-2009-39335.0WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via CVE-2009-39344.3The WebFrameLoaderClient::dispatchDidChangeLocationWithinPage function in src/webkit/glue/webframeloaderclient_impl.cc in Google Chrome befo CVE-2009-393510.0Multiple unspecified vulnerabilities in the Advanced Management Module firmware before 2.50G for the IBM BladeCenter T 8720-2xx and 8730-2xx CVE-2009-39365.8Unspecified vulnerability in Citrix Online Plug-in for Windows 11.0.x before 11.0.150 and 11.x before 11.2, Online Plug-in for Mac before 11 CVE-2009-39374.9Memory leak in Solaris TCP sockets in Sun OpenSolaris snv_106 through snv_126 allows local users to cause a denial of service (kernel memory CVE-2009-39386.8Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly ot