CVE:CVE-2008-4147
CNNVD:CNNVD-200809-336
Drupal Mailsave 模块中存在跨站脚本攻击漏洞,远程攻击者可以通过具有一个修改过的Content-Type的附件的电子邮件信息来执行任意web脚本或HTML。
solution:Upgrade drupal mailsave to a higher version than 5.x-3.2,6.x-1.2,5.x-1.0,5.x-1.x-dev,5.x-2.0,5.x-2.x-dev,5.x-3.0,5.x-3.1,5.x-3.x-dev,6.x-1.0,6.x-1.1,and avoid the version (,5.x-3.2],(,6.x-1.2],5.x-1.0,5.x-1.x-dev,5.x-2.0,5.x-2.x-dev,5.x-3.0,5.x-3.1,5.x-3.x-dev,6.x-1.0,6.x-1.1