CVE:CVE-2013-2715
CNNVD:CNNVD-201303-555
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。
Drupal中的Search API (search_api)模块7.x-1.4之前的7.x-1.x版本中存在跨站脚本漏洞。通过特制的字段名，远程认证的攻击者利用该漏洞以某些权限注入任意web脚本或HTML。
solution:Upgrade thomas_seidl search_api to a higher version than 7.x-1.0,7.x-1.0:beta1,7.x-1.0:beta10,7.x-1.0:beta2,7.x-1.0:beta3,7.x-1.0:beta4,7.x-1.0:beta5,7.x-1.0:beta6,7.x-1.0:beta7,7.x-1.0:beta8,7.x-1.0:beta9,7.x-1.0:rc1,7.x-1.1,7.x-1.2,7.x-1.3,7.x-1.x:dev,and avoid the version 7.x-1.0,7.x-1.0:beta1,7.x-1.0:beta10,7.x-1.0:beta2,7.x-1.0:beta3,7.x-1.0:beta4,7.x-1.0:beta5,7.x-1.0:beta6,7.x-1.0:beta7,7.x-1.0:beta8,7.x-1.0:beta9,7.x-1.0:rc1,7.x-1.1,7.x-1.2,7.x-1.3,7.x-1.x:dev