CVE:CVE-2008-4152
CNNVD:CNNVD-200809-341
Drupal Talk 模块 5.x-1.3之前版本5.x和6.x-1.5之前版本6.x中存在跨站脚本攻击漏洞,远程认证用户通过一个节点标题以执行任意web脚本或HTML。
solution:Upgrade drupal talk to a higher version than 5.x-1.2,6.x-1.4,5.x-1.0,5.x-1.1,6.x-1.0,6.x-1.1,6.x-1.2,and avoid the version (,5.x-1.2],(,6.x-1.4],5.x-1.0,5.x-1.1,6.x-1.0,6.x-1.1,6.x-1.2