CVE:CVE-2009-3157
CNNVD:CNNVD-200909-210
Drupal日历模块6.x-2.3版本之前的6.x版本中存在跨站脚本攻击漏洞。具有"创建新内容种类"特权的远程认证用户可以借助一个内容种类的标题，注入任意网络脚本或HTML。
solution:Upgrade karen_stevenson calendar to a higher version than 6.x-2.0,6.x-2.0:beta,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.1,6.x-2.x-dev,and avoid the version 6.x-2.0,6.x-2.0:beta,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.1,6.x-2.x-dev