CVE:CVE-2009-1507
CNNVD:CNNVD-200905-028
Drupal 5.x-2.0-beta4之前的5.x版本和6.x-2.0-beta6之前的6.x版本的Node Access User Reference模块会把一个空的CCK用户reference当作对一个匿名用户的reference，这使得远程攻击者可以绕过设置的访问限制来读取或修改节点。
solution:Upgrade drupal nodeaccess_userreference to a higher version than 5.x-1.0,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.4,5.x-2.0:beta1,5.x-2.0:beta2,5.x-2.0:beta3,6.x-1.0,6.x-1.1,6.x-1.2,6.x-1.4,6.x-1.5,6.x-1.6,6.x-1.7,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:beta5,and avoid the version 5.x-1.0,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.4,5.x-2.0:beta1,5.x-2.0:beta2,5.x-2.0:beta3,6.x-1.0,6.x-1.1,6.x-1.2,6.x-1.4,6.x-1.5,6.x-1.6,6.x-1.7,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:beta5