CVE:CVE-2009-0575
CNNVD:CNNVD-200902-329
Views Bulk Operations是Drupal中所使用的用于在节点更改视图的第三方模块。
Views Bulk Operations模块的theme_views_bulk_operations_confirmation()函数没有正确地处理节点标题。如果用户受骗查看了恶意的节点标题的话，就会导致在用户浏览器会话中注入并执行任意HTML和脚本代码。
solution:Upgrade drupal views_bulk_operations to a higher version than 5.x-1.2,6.x-1.3,5.x-1.0,5.x-1.0beta1,5.x-1.0beta3,5.x-1.0beta4,5.x-1.0beta5,5.x-1.1,6.x-1.0,6.x-1.1,6.x-1.2,and avoid the version (,5.x-1.2],(,6.x-1.3],5.x-1.0,5.x-1.0beta1,5.x-1.0beta3,5.x-1.0beta4,5.x-1.0beta5,5.x-1.1,6.x-1.0,6.x-1.1,6.x-1.2