CVE:CVE-2010-1958
CNNVD:CNNVD-201006-343
Drupal是很著名的开源内容管理平台，仿照了blog程序模式，但比普通的blog更灵活，可以做各种网站的内容管理平台。
Drupal的FileField模块存在跨站脚本攻击漏洞。具有创建和编辑权限认证用户可以查看‘文件路径’或者‘文件的URL’，从而借助文件名（filepath参数）注入任意的web脚本和HTML。
solution:Upgrade quicksketch filefield to a higher version than 5.x-1.x-dev,5.x-2.0,5.x-2.1,5.x-2.2,5.x-2.3,5.x-2.3:rc2,5.x-2.3:rc3,5.x-2.3:rc4,5.x-2.4,5.x-2.x-dev,6.x-1.0:alpha1,6.x-1.0:alpha2,6.x-1.0:alpha3,6.x-1.0:beta1,6.x-1.0:beta2,6.x-1.0:beta3,6.x-3.0,6.x-3.0:alpha1,6.x-3.0:alpha2,6.x-3.0:alpha3,6.x-3.0:alpha4,6.x-3.0:alpha5,6.x-3.0:alpha6,6.x-3.0:alpha7,6.x-3.0:beta1,6.x-3.0:beta2,6.x-3.0:beta3,6.x-3.0:rc1,6.x-3.1,6.x-3.2,6.x-3.3,6.x-3.5,6.x-3.x-dev,and avoid the version 5.x-1.x-dev,5.x-2.0,5.x-2.1,5.x-2.2,5.x-2.3,5.x-2.3:rc2,5.x-2.3:rc3,5.x-2.3:rc4,5.x-2.4,5.x-2.x-dev,6.x-1.0:alpha1,6.x-1.0:alpha2,6.x-1.0:alpha3,6.x-1.0:beta1,6.x-1.0:beta2,6.x-1.0:beta3,6.x-3.0,6.x-3.0:alpha1,6.x-3.0:alpha2,6.x-3.0:alpha3,6.x-3.0:alpha4,6.x-3.0:alpha5,6.x-3.0:alpha6,6.x-3.0:alpha7,6.x-3.0:beta1,6.x-3.0:beta2,6.x-3.0:beta3,6.x-3.0:rc1,6.x-3.1,6.x-3.2,6.x-3.3,6.x-3.5,6.x-3.x-dev