CVE:CVE-2009-4473
CNNVD:CNNVD-200912-414
WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET中存在多个跨站脚本攻击漏洞。远程攻击者可以借助(1) css, (2) eca, (3) id, 和 (4) skin参数注入任意web脚本或HTML。
solution:Upgrade ektron cms4000.net to a higher version than 7.6.0,7.6.0:sp1,7.6.0:sp2,7.6.1,7.6.1:sp1,7.6.1:sp2,7.6.1:sp3,7.6.1:sp4,7.6.1.53,7.6.5,7.6.5:sp1,7.6.5:sp2,7.6.5:sp3,7.6.6,7.6.6:sp1,7.6.6:sp2,7.6.6.47,7.52,7.53,7.53:sp2,7.54,7.54:sp2,and avoid the version 7.6.0,7.6.0:sp1,7.6.0:sp2,7.6.1,7.6.1:sp1,7.6.1:sp2,7.6.1:sp3,7.6.1:sp4,7.6.1.53,7.6.5,7.6.5:sp1,7.6.5:sp2,7.6.5:sp3,7.6.6,7.6.6:sp1,7.6.6:sp2,7.6.6.47,7.52,7.53,7.53:sp2,7.54,7.54:sp2