CVE:CVE-2009-3652
CNNVD:CNNVD-200910-174
Drupal Organic Groups (OG) 5.x-7.x5.x-7.4版本之前的5.x-7.x版本, 5.x-8.1版本之前的版本5.x-8.x,以及6.x-1.4版本之前的6.x-1.x版本中存在跨站脚本攻击漏洞。 具有创建或编辑群组节点许可的远程验证用户可以借助User-Agent HTTP页眉，注入任意web或HTML。
solution:Upgrade moshe_weitzman organic_groups to a higher version than 5.x-7.0,5.x-7.0-rc1,5.x-7.0-rc2,5.x-7.0-rc3,5.x-7.0-rc4,5.x-7.0-rc5,5.x-7.1,5.x-7.2,5.x-7.3,5.x-8.0,6.x-1.0,6.x-1.0-beta1,6.x-1.0-rc1,6.x-1.0-rc2,6.x-1.0-rc3,6.x-1.0-rc4,6.x-1.0-rc5,6.x-1.0-rc6,6.x-1.0-rc7,6.x-1.0-rc8,6.x-1.0-rc9,6.x-1.1,6.x-1.2,6.x-1.3,and avoid the version 5.x-7.0,5.x-7.0-rc1,5.x-7.0-rc2,5.x-7.0-rc3,5.x-7.0-rc4,5.x-7.0-rc5,5.x-7.1,5.x-7.2,5.x-7.3,5.x-8.0,6.x-1.0,6.x-1.0-beta1,6.x-1.0-rc1,6.x-1.0-rc2,6.x-1.0-rc3,6.x-1.0-rc4,6.x-1.0-rc5,6.x-1.0-rc6,6.x-1.0-rc7,6.x-1.0-rc8,6.x-1.0-rc9,6.x-1.1,6.x-1.2,6.x-1.3