CVE:CVE-2013-4140
CNNVD:CNNVD-201307-274
Drupal平台下的TinyBox (Simple Splash)模块7.x-2.1及之前版本中存在跨站脚本漏洞。具有“管理员tinybox”权限的远程经过授权的攻击者可利用该漏洞以‘管理员tinybox’权限注入任意Web脚本或HTML代码。
solution:Upgrade drupalisme tinybox to a higher version than 7.x-2.1,7.x-1.0,7.x-1.0:alpha1,7.x-1.0:alpha2,7.x-1.0:alpha3,7.x-1.0:alpha4,7.x-1.0:beta1,7.x-1.0:beta2,7.x-1.1,7.x-2.0,and avoid the version (,7.x-2.1],7.x-1.0,7.x-1.0:alpha1,7.x-1.0:alpha2,7.x-1.0:alpha3,7.x-1.0:alpha4,7.x-1.0:beta1,7.x-1.0:beta2,7.x-1.1,7.x-2.0