CVE:CVE-2010-4519
CNNVD:CNNVD-201012-309
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。
基于Drupal的Views模块5.x-1.8之前的5.x版本以及6.x-2.11之前的6.x版本中的Views UI实现中存在多个跨站请求伪造漏洞。远程攻击者可以利用这些漏洞劫持用于请求(1)启动所有Views或者(2)禁用所有Views的管理员认证。
solution:Upgrade earl_miles views to a higher version than 5.x-1.0,5.x-1.1:beta,5.x-1.2:beta1,5.x-1.3:beta1,5.x-1.4:rc1,5.x-1.4-2:rc1,5.x-1.5,5.x-1.6,5.x-1.6:beta,5.x-1.6:beta2,5.x-1.6:beta3,5.x-1.6:beta4,5.x-1.6:beta5,5.x-1.7,5.x-1.x:dev,6.x-2.0,6.x-2.0:alpha1,6.x-2.0:alpha2,6.x-2.0:alpha3,6.x-2.0:alpha4,6.x-2.0:alpha5,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.1,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6,6.x-2.7,6.x-2.8,6.x-2.9,6.x-2.10,6.x-2.x:dev,6.x-3.0:alpha1,6.x-3.0:alpha2,6.x-3.0:alpha3,6.x-3.x:dev,and avoid the version 5.x-1.0,5.x-1.1:beta,5.x-1.2:beta1,5.x-1.3:beta1,5.x-1.4:rc1,5.x-1.4-2:rc1,5.x-1.5,5.x-1.6,5.x-1.6:beta,5.x-1.6:beta2,5.x-1.6:beta3,5.x-1.6:beta4,5.x-1.6:beta5,5.x-1.7,5.x-1.x:dev,6.x-2.0,6.x-2.0:alpha1,6.x-2.0:alpha2,6.x-2.0:alpha3,6.x-2.0:alpha4,6.x-2.0:alpha5,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.1,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6,6.x-2.7,6.x-2.8,6.x-2.9,6.x-2.10,6.x-2.x:dev,6.x-3.0:alpha1,6.x-3.0:alpha2,6.x-3.0:alpha3,6.x-3.x:dev