Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/103138 | Third Party Advisory VDB Entry |
| https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html | Mailing List Third Party Advisory |
| https://www.debian.org/security/2018/dsa-4123 | Third Party Advisory |
| https://www.drupal.org/sa-core-2018-001 | Vendor Advisory |
| http://www.securityfocus.com/bid/103138 | Third Party Advisory VDB Entry |
| https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html | Mailing List Third Party Advisory |
| https://www.debian.org/security/2018/dsa-4123 | Third Party Advisory |
| https://www.drupal.org/sa-core-2018-001 | Vendor Advisory |
Configurations
History
21 Nov 2024, 03:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/103138 - Third Party Advisory, VDB Entry | |
| References | () https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html - Mailing List, Third Party Advisory | |
| References | () https://www.debian.org/security/2018/dsa-4123 - Third Party Advisory | |
| References | () https://www.drupal.org/sa-core-2018-001 - Vendor Advisory |
Information
Published : 2018-03-01 23:29
Updated : 2024-11-21 03:30
NVD link : CVE-2017-6927
Mitre link : CVE-2017-6927
CVE.ORG link : CVE-2017-6927
JSON object : View
Products Affected
debian
- debian_linux
drupal
- drupal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')