CVE-2026-3213：Drupal Anti-Spam XSS漏洞 (≤9.7.0)

CVE-2026-3213 影响 Drupal 的 Anti-Spam by CleanTalk 模块，允许跨站脚本攻击 (XSS)。这意味着攻击者可以将恶意代码注入到 Drupal 网站页面中，这些代码将在用户的浏览器中执行。此代码可以窃取敏感信息，例如登录凭据，或将用户重定向到恶意网站。此漏洞的严重程度为 CVSS 4.7，表明存在中等风险。根本原因是 Web 页面生成过程中输入未得到适当的清理。使用 9.7.0 之前的 Anti-Spam by CleanTalk 模块版本的网站容易受到此攻击。为了降低此风险并保护用户数据的完整性和安全性，更新模块至关重要。

Websites utilizing the Drupal Anti-Spam by CleanTalk module and running versions prior to 9.7.0 are at risk. This includes sites with user-generated content, forums, or any functionality that accepts user input, as these are prime targets for XSS attacks. Shared hosting environments using Drupal are particularly vulnerable, as they may not have immediate control over module updates.

• drupal: Use Drupal’s security audit module to scan for outdated modules. Check the Drupal error logs for any unusual JavaScript execution patterns. • generic web: Monitor web server access logs for suspicious requests containing JavaScript code. Use a WAF to detect and block XSS payloads. • wordpress / composer / npm: N/A - This vulnerability is specific to the Drupal Anti-Spam by CleanTalk module. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability does not directly impact database systems.

1. 2026-03-25Disclosure

   disclosure

1. 已保留2026-02-25
2. 发布日期2026-03-25
3. 修改日期2026-03-31
4. EPSS 更新日期2026-04-02

此漏洞的解决方案是将 Anti-Spam by CleanTalk 模块更新到 9.7.0 或更高版本。此更新包含必要的修复程序，以清理输入并防止恶意代码的执行。建议尽快执行更新，以尽量减少被利用的风险。此外，请检查服务器日志中是否存在可能表明攻击尝试的任何可疑活动。实施强大的 Web 安全策略，包括验证和清理所有用户输入，是防止未来 XSS 漏洞的推荐做法。定期安全审计也有助于识别和纠正潜在的安全问题。