CVE-2017-6927GHSA-585J-5449-MF5M
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.4.5, 7.57
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
Timeline
- CVE published
- Record last updated
Affected versions
- Drupal.org Drupal Core
Version range not reported
- drupal/corePackagist
From 8.4.0 · fixed in 8.4.5
- drupal/corePackagist
From 7.0 · fixed in 7.57
- drupal/drupalPackagist
From 8.4.0 · fixed in 8.4.5
- drupal/drupalPackagist
From 7.0 · fixed in 7.57