CVE:CVE-2014-8735
CNNVD:CNNVD-201410-1418
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。Bad Behavior是其中的一个垃圾屏蔽模块。
Drupal Bad Behavior模块6.x-2.2216之前6.x-2.x版本和7.x-2.2216之前7.x-2.x版本中存在安全漏洞，该漏洞源于程序记录用户名和密码。远程攻击者可通过读取日志文件利用该漏洞以‘administer bad behavior’权限利用该漏洞获取敏感信息。
solution:Upgrade bad_behavior_project bad_behavior to a higher version than 6.x-1.0:rc1,6.x-1.0:rc2,6.x-1.x:dev,6.x-2.1,6.x-2.2:rc14,6.x-2.13,6.x-2.14,6.x-2.113,6.x-2.114,6.x-2.115,6.x-2.116,6.x-2.200:rc14,6.x-2.214,6.x-2.215,6.x-2.216,6.x-2.217,6.x-2.220,6.x-2.221,6.x-2.222,6.x-2.223,6.x-2.225,6.x-2.226,6.x-2.227,6.x-2.228,6.x-2.2210,6.x-2.2211,6.x-2.2212,6.x-2.2213,6.x-2.2214,6.x-2.2215,7.x-2.220,7.x-2.221,7.x-2.222,7.x-2.223,7.x-2.225,7.x-2.226,7.x-2.227,7.x-2.228,7.x-2.2210,7.x-2.2211,7.x-2.2212,7.x-2.2213,7.x-2.2214,7.x-2.2215,7.x-2.2216,7.x-2.x:dev,and avoid the version 6.x-1.0:rc1,6.x-1.0:rc2,6.x-1.x:dev,6.x-2.1,6.x-2.2:rc14,6.x-2.13,6.x-2.14,6.x-2.113,6.x-2.114,6.x-2.115,6.x-2.116,6.x-2.200:rc14,6.x-2.214,6.x-2.215,6.x-2.216,6.x-2.217,6.x-2.220,6.x-2.221,6.x-2.222,6.x-2.223,6.x-2.225,6.x-2.226,6.x-2.227,6.x-2.228,6.x-2.2210,6.x-2.2211,6.x-2.2212,6.x-2.2213,6.x-2.2214,6.x-2.2215,7.x-2.220,7.x-2.221,7.x-2.222,7.x-2.223,7.x-2.225,7.x-2.226,7.x-2.227,7.x-2.228,7.x-2.2210,7.x-2.2211,7.x-2.2212,7.x-2.2213,7.x-2.2214,7.x-2.2215,7.x-2.2216,7.x-2.x:dev