CVE:CVE-2015-4364
CNNVD:CNNVD-201503-200
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。Campaign Monitor是其中的一个通过集成Campaign Monitor API以能够订阅Drupal站点管理列表的模块。
Drupal Campaign Monitor模块7.x-1.0版本的includes/campaignmonitor_lists.admin.inc文件中存在跨站请求伪造漏洞。远程攻击者可通过向admin/config/services/campaignmonitor/lists/%/enable URI发送请求利用该漏洞启用列表订阅；向admin/config/services/campaignmonitor/lists/%/disable URI发送请求利用该漏洞禁用列表订阅。
solution:Upgrade campaign_monitor_project campaign_monitor to a higher version than 7.x-1.0,and avoid the version 7.x-1.0