CVE:CVE-2010-2352
CNNVD:CNNVD-201006-349
Drupal是很著名的开源内容管理平台，仿照了blog程序模式，但比普通的blog更灵活，可以做各种网站的内容管理平台。
Drupal的Content Construction Kit (CCK)模块的Node Reference功能模块在显示引用节点之前没有进行访问检查，远程攻击者可以读取控制节点。
solution:Upgrade karen_stevenson cck to a higher version than 5.x-1.0:beta,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.7,5.x-1.x:dev,6.x-2.0,6.x-2.0:beta,6.x-2.0:rc10,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.0:rc7,6.x-2.0:rc8,6.x-2.0:rc9,6.x-2.1,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6,and avoid the version 5.x-1.0:beta,5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.7,5.x-1.x:dev,6.x-2.0,6.x-2.0:beta,6.x-2.0:rc10,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.0:rc6,6.x-2.0:rc7,6.x-2.0:rc8,6.x-2.0:rc9,6.x-2.1,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6; Upgrade yves_chedemois cck to a higher version than 5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.6-1,5.x-1.8,5.x-1.9,5.x-1.10,and avoid the version 5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.6-1,5.x-1.8,5.x-1.9,5.x-1.10