CVE:CVE-2007-5621
CNNVD:CNNVD-200710-424
Drupal Token模块4.7.x-1.5版本之前的版本, 和5.x-1.9版本之前的5.x版本中存在多个跨站脚本攻击漏洞; 当在ASIN Field, CCK e-Commerce, Fullname字段, Invite, Node Relativity, Pathauto, PayPal Node, 和 Ubercart模块中运行时;具有一个post评论特权的远程验证用户可以借助未明向量，注入任意web脚本或HTML，该漏洞与(1) comments, (2) vocabulary names, (3) term names,和(4)用户名相关。
solution:Upgrade drupal asin_field_module to a higher version than *; Upgrade drupal drupal to a higher version than 4.7,5.0,5.1,5.2,and avoid the version 4.7,5.0,5.1,5.2; Upgrade drupal e-commerce_module to a higher version than *; Upgrade drupal fullname_field_for_cck to a higher version than *; Upgrade drupal invite_module to a higher version than *; Upgrade drupal node_relativity_module to a higher version than *; Upgrade drupal pathauto_module to a higher version than *; Upgrade drupal paypal_node_module to a higher version than *; Upgrade drupal token_module to a higher version than 1.4,1.8,and avoid the version (,1.4],(,1.8]; Upgrade drupal ubercart_module to a higher version than *