CVE:CVE-2015-6807
CNNVD:CNNVD-201509-049
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。Mass Contact是其中的一个提供了邮件群发功能的模块。
Drupal Mass Contact模块6.x-1.6之前6.x-1.x版本和7.x-1.1之前7.x-1.x版本中存在跨站脚本漏洞。远程攻击者可借助类别标签利用该漏洞以‘administer mass contact’权限注入任意Web脚本或HTML。
solution:Upgrade mass_contact_project mass_contact to a higher version than 7.x-1.0,7.x-1.0:alpha1,7.x-1.0:alpha2,7.x-1.0:alpha3,7.x-1.0:alpha4,7.x-1.0:alpha5,7.x-1.0:alpha6,7.x-1.0:beta1,7.x-1.0:beta2,7.x-1.0:beta3,7.x-1.x:dev,6.x-1.0,6.x-1.0:beta1,6.x-1.0:beta2,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.4,6.x-1.5,6.x-1.x:dev,and avoid the version 7.x-1.0,7.x-1.0:alpha1,7.x-1.0:alpha2,7.x-1.0:alpha3,7.x-1.0:alpha4,7.x-1.0:alpha5,7.x-1.0:alpha6,7.x-1.0:beta1,7.x-1.0:beta2,7.x-1.0:beta3,7.x-1.x:dev,6.x-1.0,6.x-1.0:beta1,6.x-1.0:beta2,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.4,6.x-1.5,6.x-1.x:dev