CVE:CVE-2012-5654
CNNVD:CNNVD-201301-027
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。
Drupal中的Nodewords: D6 Meta Tags模块6.x-1.14之前版本中存在漏洞，在被设置为自动从节点文本中生成description元标签的条件下，程序在新建标签时没有正确过滤节点内容。通过读取(1)description(2)dc.description或(3)og:description元标签，远程攻击者利用该漏洞获得敏感信息。
solution:Upgrade nodewords_project nodewords to a higher version than *:beta2,4.7-1.0,4.7-1.1,4.7-1.2,4.7-1.x:dev,5.x-1.0,5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.7,5.x-1.8,5.x-1.8:rc1,5.x-1.9,5.x-1.10,5.x-1.11,5.x-1.12,5.x-1.13,5.x-1.x:dev,6.x-1.0,6.x-1.0:rc1,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.3:alpha1,6.x-1.3:alpha2,6.x-1.3:beta3,6.x-1.3:beta4,6.x-1.3:beta5,6.x-1.4,6.x-1.5,6.x-1.6,6.x-1.7,6.x-1.8,6.x-1.9,6.x-1.10,6.x-1.11,6.x-1.12:beta1,6.x-1.12:beta2,6.x-1.12:beta3,6.x-1.12:beta4,6.x-1.12:beta5,6.x-1.12:beta6,6.x-1.12:beta7,6.x-1.12:beta8,6.x-1.12:beta9,6.x-1.12:rc1,6.x-1.13,6.x-1.13:rc1,6.x-1.13:rc2,6.x-1.14:beta1,6.x-1.x:dev,and avoid the version *:beta2,4.7-1.0,4.7-1.1,4.7-1.2,4.7-1.x:dev,5.x-1.0,5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.7,5.x-1.8,5.x-1.8:rc1,5.x-1.9,5.x-1.10,5.x-1.11,5.x-1.12,5.x-1.13,5.x-1.x:dev,6.x-1.0,6.x-1.0:rc1,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.3:alpha1,6.x-1.3:alpha2,6.x-1.3:beta3,6.x-1.3:beta4,6.x-1.3:beta5,6.x-1.4,6.x-1.5,6.x-1.6,6.x-1.7,6.x-1.8,6.x-1.9,6.x-1.10,6.x-1.11,6.x-1.12:beta1,6.x-1.12:beta2,6.x-1.12:beta3,6.x-1.12:beta4,6.x-1.12:beta5,6.x-1.12:beta6,6.x-1.12:beta7,6.x-1.12:beta8,6.x-1.12:beta9,6.x-1.12:rc1,6.x-1.13,6.x-1.13:rc1,6.x-1.13:rc2,6.x-1.14:beta1,6.x-1.x:dev