CVE:CVE-2015-3344
CNNVD:CNNVD-201504-414
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。Course是其中的一个远程教学课程模块。
Drupal Course模块6.x-1.2之前6.x-1.x版本和7.x-1.4之前7.x-1.x版本中存在跨站脚本漏洞。远程攻击者可借助节点标题利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade dlc_solutions course to a higher version than 6.x-1.0-alpha1,6.x-1.0-rc1,6.x-1.0-rc2,6.x-1.0-rc3,6.x-1.0-rc4,6.x-1.0-rc5,6.x-1.0-rc6,6.x-1.0-rc7,6.x-1.0-rc8,6.x-1.0-rc9,6.x-1.0-rc10,6.x-1.1,6.x-1.x-dev,7.x-1.0,7.x-1.0-alpha1,7.x-1.0-alpha2,7.x-1.0-alpha3,7.x-1.0-beta1,7.x-1.0-beta2,7.x-1.0-beta3,7.x-1.0-rc1,7.x-1.0-rc2,7.x-1.0-rc3,7.x-1.0-rc4,7.x-1.1,7.x-1.2,7.x-1.3,7.x-1.x-dev,and avoid the version 6.x-1.0-alpha1,6.x-1.0-rc1,6.x-1.0-rc2,6.x-1.0-rc3,6.x-1.0-rc4,6.x-1.0-rc5,6.x-1.0-rc6,6.x-1.0-rc7,6.x-1.0-rc8,6.x-1.0-rc9,6.x-1.0-rc10,6.x-1.1,6.x-1.x-dev,7.x-1.0,7.x-1.0-alpha1,7.x-1.0-alpha2,7.x-1.0-alpha3,7.x-1.0-beta1,7.x-1.0-beta2,7.x-1.0-beta3,7.x-1.0-rc1,7.x-1.0-rc2,7.x-1.0-rc3,7.x-1.0-rc4,7.x-1.1,7.x-1.2,7.x-1.3,7.x-1.x-dev