CVE:CVE-2009-4773
CNNVD:CNNVD-201004-326
Drupal是一款开放源码的内容管理平台。
Drupal的Ubercart模块的order-management功能在实现上存在跨站请求伪造漏洞。远程攻击者可以借助未知向量挟持未明受害者的认证。
solution:Upgrade ubercart ubercart to a higher version than 5.x-1.0,5.x-1.0:alpha1,5.x-1.0:alpha2,5.x-1.0:alpha3,5.x-1.0:alpha4,5.x-1.0:alpha5,5.x-1.0:alpha6,5.x-1.0:alpha6b,5.x-1.0:alpha6c,5.x-1.0:alpha7,5.x-1.0:alpha7b,5.x-1.0:alpha7c,5.x-1.0:alpha7d,5.x-1.0:alpha7e,5.x-1.0:alpha8,5.x-1.0:beta1,5.x-1.0:beta2,5.x-1.0:beta3,5.x-1.0:beta4,5.x-1.0:beta5,5.x-1.0:beta6,5.x-1.0:beta7,5.x-1.0:rc1,5.x-1.0:rc2,5.x-1.0:rc3,5.x-1.0:rc4,5.x-1.0:rc5,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.3:rc1,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.8,6.x-2.0,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:beta5,6.x-2.0:beta6,6.x-2.0:dev,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.0:rc7,and avoid the version 5.x-1.0,5.x-1.0:alpha1,5.x-1.0:alpha2,5.x-1.0:alpha3,5.x-1.0:alpha4,5.x-1.0:alpha5,5.x-1.0:alpha6,5.x-1.0:alpha6b,5.x-1.0:alpha6c,5.x-1.0:alpha7,5.x-1.0:alpha7b,5.x-1.0:alpha7c,5.x-1.0:alpha7d,5.x-1.0:alpha7e,5.x-1.0:alpha8,5.x-1.0:beta1,5.x-1.0:beta2,5.x-1.0:beta3,5.x-1.0:beta4,5.x-1.0:beta5,5.x-1.0:beta6,5.x-1.0:beta7,5.x-1.0:rc1,5.x-1.0:rc2,5.x-1.0:rc3,5.x-1.0:rc4,5.x-1.0:rc5,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.3:rc1,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.8,6.x-2.0,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:beta5,6.x-2.0:beta6,6.x-2.0:dev,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.0:rc7