PT-2018-8351 · Drupal · Drupal

Grant Gaudet · Publicado 2018-02-24 · Atualizado 2022-05-14 · CVE-2017-6927

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Drupal versions 7.x before 7.57

Description The issue arises from the Drupal.checkPlain() JavaScript function, which is intended to escape potentially dangerous text before it is outputted to HTML. However, this function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting issue under certain circumstances. The PHP functions provided by Drupal for HTML escaping are not affected by this issue.

Recommendations For Drupal 8.4.x versions before 8.4.5, update to version 8.4.5 or later. For Drupal 7.x versions before 7.57, update to version 7.57 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-6927

DLA-1295-1

DSA-4123-1

GHSA-585J-5449-MF5M

Produtos afetados

Drupal

Referências · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://debian.org/security/2018/dsa-4123 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6927 · Nota de Segurança
• http://securityfocus.com/bid/103138 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6927 · Aviso do Fabricante
• https://drupal.org/sa-core-2018-001 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-6927 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html · Nota
• https://osv.dev/vulnerability/CVE-2017-6927 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-6927 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4123-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-585j-5449-mf5m · Aviso do Fabricante