CVE:CVE-2009-3156
CNNVD:CNNVD-200909-209
Drupal日期模块6.x-2.3版本之前的6.x版本中的Date Tools sub-module中存在跨站脚本攻击漏洞。具有"使用日期工具"或"管理内容种类"特权的远程认证用户,可以借助一个"内容种类标签"字段，注入任意网络脚本或HTML。
solution:Upgrade drupal drupal to a higher version than *; Upgrade karen_stevenson date to a higher version than 6.x-1.0-beta,6.x-1.x-dev,6.x-2.0,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.0-beta,6.x-2.0-beta2,6.x-2.0-beta3,6.x-2.0-beta4,6.x-2.1,6.x-2.2,and avoid the version 6.x-1.0-beta,6.x-1.x-dev,6.x-2.0,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.0-beta,6.x-2.0-beta2,6.x-2.0-beta3,6.x-2.0-beta4,6.x-2.1,6.x-2.2