CVE-2017-6927

CVE-2017-6927: falha em Drupal.org Drupal Core

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Drupal Core+ Monitorar drupal/core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.6%
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
Produtos afetados
Drupal.org · Drupal Core
CVEs relacionadas — Drupal.org Drupal Core

No mesmo produto, das mais perigosas para as menos.

CVE-2017-6920—CVE-2017-6920EPSS 20.2%CVE-2017-6930—CVE-2017-6930EPSS 1.3%CVE-2017-6929—CVE-2017-6929EPSS 1.2%CVE-2017-6926—CVE-2017-6926EPSS 1.2%CVE-2017-6932—CVE-2017-6932EPSS 1.2%CVE-2017-6931—CVE-2017-6931EPSS 1.1%