Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2009-3652: Drupal Organic Groups module lets authorized users inject scripts

CVE-2009-3652 · published 17 years ago

Summary

The Organic Groups add‑on for Drupal lets users who can create or edit group pages insert malicious web code through the browser’s User‑Agent field. An attacker could cause unwanted scripts to run in the browsers of anyone viewing those pages, potentially stealing data or hijacking sessions. Update the Organic Groups module to the latest version or apply the vendor’s patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
moshe_weitzman	organic_groups	5.x-7.0 5.x-7.0-rc1 5.x-7.0-rc2 5.x-7.0-rc3 5.x-7.0-rc4 5.x-7.0-rc5 5.x-7.1 5.x-7.2 5.x-7.3 5.x-8.0 6.x-1.0 6.x-1.0-beta1 12 more version ranges `cpe:2.3:a:moshe_weitzman:organic_groups:5.x-7.0:::::::*`

Original advisory text

Cross-site scripting (XSS) vulnerability in Organic Groups (OG) 5.x-7.x before 5.x-7.4, 5.x-8.x before 5.x-8.1, and 6.x-1.x before 6.x-1.4, a module for Drupal, allows remote authenticated users, with create or edit group nodes permissions, to inject arbitrary web script or HTML via the User-Agent HTTP header, a different issue than CVE-2008-3095.

References

http://drupal.org/node/592358 Patch Vendor Advisory
http://drupal.org/node/592410 Patch Vendor Advisory
http://drupal.org/node/592412 Patch Vendor Advisory
http://drupal.org/node/592414 Patch Vendor Advisory
http://osvdb.org/58445
http://secunia.com/advisories/36923 Patch Vendor Advisory
http://www.securityfocus.com/bid/36558 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/53570

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

3.5 Low

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published9 Oct 2009

Updated1 Nov 2026

First seen29 Sep 2026

Sources

CVE-2009-3652 · NVD

Track software like this

Free during beta