CVE:CVE-2009-3206
CNNVD:CNNVD-200909-313
Drupal ImageCache模块5.x-2.5版本之前的5.x版本以及6.x-2.0-beta10版本之前的6.x版本中存在多个跨站脚本攻击漏洞。具有"管理员图像文档"许可的远程认证用户可以借助未明向量，注入任意WEB脚本或HTML。
solution:Upgrade drewish imagecache to a higher version than 5.x-1.0,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.x:dev,5.x-2.0,5.x-2.0:alpha,5.x-2.0:beta,5.x-2.0:rc1,5.x-2.0:rc2,5.x-2.1,5.x-2.2,5.x-2.3,5.x-2.4,5.x-2.x:dev,6.x-1.0:alpha1,6.x-1.0:alpha2,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:beta5,6.x-2.0:beta6,6.x-2.0:beta7,6.x-2.0:beta8,6.x-2.0:beta9,6.x-2.x-dev,and avoid the version 5.x-1.0,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.x:dev,5.x-2.0,5.x-2.0:alpha,5.x-2.0:beta,5.x-2.0:rc1,5.x-2.0:rc2,5.x-2.1,5.x-2.2,5.x-2.3,5.x-2.4,5.x-2.x:dev,6.x-1.0:alpha1,6.x-1.0:alpha2,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:beta5,6.x-2.0:beta6,6.x-2.0:beta7,6.x-2.0:beta8,6.x-2.0:beta9,6.x-2.x-dev