CVE-2012-5539

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-12-03 · updated 2026-06-16
Weakness: CWE-264

Description

The Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote authenticated users to post to arbitrary groups by modifying their own account while a pending membership is waiting to be approved.

Affected products

Organic Groups (OG) module: 7.x-1.0, 7.x-1.0-alpha1, 7.x-1.1, 7.x-1.1-rc1, 7.x-1.1-rc2, 7.x-1.1-rc3 (+5)

References

http://drupal.org/node/1795906
http://drupal.org/node/1796036
http://www.openwall.com/lists/oss-security/2012/11/20/4
http://drupal.org/node/1795906
http://drupal.org/node/1796036
http://www.openwall.com/lists/oss-security/2012/11/20/4

Get alerted when CVE-2012-5539 or the next vulnerability affects your stack