CVE:CVE-2008-6972
CNNVD:CNNVD-200908-159
Drupal Content Construction Kit (CCK) 5.x到5.x-1.8版本存在多个跨站脚本攻击漏洞。拥有"管理内容"许可的远程认证用户可以借助(1)"字段标签"(2)"帮助对话框" 或(3)"许可值"设置 ，注入任意的web脚本或HTML。
solution:Upgrade karen_stevenson cck to a higher version than 5.x-1.0-beta,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.7,5.x-1.x-dev,and avoid the version 5.x-1.0-beta,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.7,5.x-1.x-dev; Upgrade yves_chedemois cck to a higher version than 5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.6-1,5.x-1.8,and avoid the version 5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.6-1,5.x-1.8