CVE:CVE-2016-7570
CNNVD:CNNVD-201609-661
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。
Drupal 8.1.10之前的8.x版本中存在安全漏洞，该漏洞源于程序没有正确检查‘Administer comments’权限。远程攻击者可借利用该漏洞设置任意节点的评论可见。
solution:Upgrade drupal drupal to a higher version than 8.0.0,8.0.0:alpha10,8.0.0:alpha11,8.0.0:alpha12,8.0.0:alpha13,8.0.0:alpha14,8.0.0:alpha15,8.0.0:alpha2,8.0.0:alpha3,8.0.0:alpha4,8.0.0:alpha5,8.0.0:alpha6,8.0.0:alpha7,8.0.0:alpha8,8.0.0:alpha9,8.0.0:beta1,8.0.0:beta10,8.0.0:beta11,8.0.0:beta12,8.0.0:beta13,8.0.0:beta14,8.0.0:beta15,8.0.0:beta16,8.0.0:beta2,8.0.0:beta3,8.0.0:beta4,8.0.0:beta6,8.0.0:beta7,8.0.0:beta9,8.0.0:rc1,8.0.0:rc2,8.0.0:rc3,8.0.0:rc4,8.0.1,8.0.2,8.0.3,8.0.4,8.0.5,8.0.6,8.1.0,8.1.0:beta1,8.1.0:beta2,8.1.0:rc1,8.1.1,8.1.2,8.1.3,8.1.4,8.1.5,8.1.6,8.1.7,8.1.8,8.1.9,and avoid the version 8.0.0,8.0.0:alpha10,8.0.0:alpha11,8.0.0:alpha12,8.0.0:alpha13,8.0.0:alpha14,8.0.0:alpha15,8.0.0:alpha2,8.0.0:alpha3,8.0.0:alpha4,8.0.0:alpha5,8.0.0:alpha6,8.0.0:alpha7,8.0.0:alpha8,8.0.0:alpha9,8.0.0:beta1,8.0.0:beta10,8.0.0:beta11,8.0.0:beta12,8.0.0:beta13,8.0.0:beta14,8.0.0:beta15,8.0.0:beta16,8.0.0:beta2,8.0.0:beta3,8.0.0:beta4,8.0.0:beta6,8.0.0:beta7,8.0.0:beta9,8.0.0:rc1,8.0.0:rc2,8.0.0:rc3,8.0.0:rc4,8.0.1,8.0.2,8.0.3,8.0.4,8.0.5,8.0.6,8.1.0,8.1.0:beta1,8.1.0:beta2,8.1.0:rc1,8.1.1,8.1.2,8.1.3,8.1.4,8.1.5,8.1.6,8.1.7,8.1.8,8.1.9