PT-2018-8351 · Drupal · Drupal

Grant Gaudet · Published 2018-02-24 · Updated 2022-05-14 · CVE-2017-6927

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 8.4.x before 8.4.5 Drupal versions 7.x before 7.57

Description The issue arises from the Drupal.checkPlain() JavaScript function, which is intended to escape potentially dangerous text before it is outputted to HTML. However, this function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting issue under certain circumstances. The PHP functions provided by Drupal for HTML escaping are not affected by this issue.

Recommendations For Drupal 8.4.x versions before 8.4.5, update to version 8.4.5 or later. For Drupal 7.x versions before 7.57, update to version 7.57 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-6927

DLA-1295-1

DSA-4123-1

GHSA-585J-5449-MF5M

Affected Products

Drupal

References · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml · Exploit
• https://debian.org/security/2018/dsa-4123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6927 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6927 · Vendor Advisory
• https://drupal.org/sa-core-2018-001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6927 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6927 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6927 · Security Note
• https://osv.dev/vulnerability/DSA-4123-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-585j-5449-mf5m · Vendor Advisory
• https://github.com/drupal/core · Note
• http://securityfocus.com/bid/103138 · Note
• https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html · Note