CVE-2017-6927

Low

Low Medium High Critical

CVSS Score

Published: Mar 01, 2018

Last Modified: Nov 21, 2024

Vulnerability Description

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.

Known Affected Software

60 configuration(s) from 2 vendor(s)

debian_linux

Version:

8.0

CPE:

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

debian_linux

Version:

7.0

CPE:

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

debian_linux

Version:

9.0

CPE:

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

drupal

Version:

7.53

CPE:

cpe:2.3:a:drupal:drupal:7.53:*:*:*:*:*:*:*

drupal

Version:

7.38

CPE:

cpe:2.3:a:drupal:drupal:7.38:*:*:*:*:*:*:*

drupal

Version:

7.26

CPE:

cpe:2.3:a:drupal:drupal:7.26:*:*:*:*:*:*:*

drupal

Version:

8.4.2

CPE:

cpe:2.3:a:drupal:drupal:8.4.2:*:*:*:*:*:*:*

drupal

Version:

7.9

CPE:

cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:*

drupal

Version:

7.5

CPE:

cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:*

drupal

Version:

7.3

CPE:

cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:*

drupal

Version:

7.32

CPE:

cpe:2.3:a:drupal:drupal:7.32:*:*:*:*:*:*:*

drupal

Version:

7.24

CPE:

cpe:2.3:a:drupal:drupal:7.24:*:*:*:*:*:*:*

drupal

Version:

7.41

CPE:

cpe:2.3:a:drupal:drupal:7.41:*:*:*:*:*:*:*

drupal

Version:

7.42

CPE:

cpe:2.3:a:drupal:drupal:7.42:*:*:*:*:*:*:*

drupal

Version:

7.4

CPE:

cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:*

drupal

Version:

8.4.3

CPE:

cpe:2.3:a:drupal:drupal:8.4.3:*:*:*:*:*:*:*

drupal

Version:

7.11

CPE:

cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:*

drupal

Version:

7.0

CPE:

cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:*

drupal

Version:

7.21

CPE:

cpe:2.3:a:drupal:drupal:7.21:*:*:*:*:*:*:*

drupal

Version:

7.27

CPE:

cpe:2.3:a:drupal:drupal:7.27:*:*:*:*:*:*:*

drupal

Version:

7.50

CPE:

cpe:2.3:a:drupal:drupal:7.50:*:*:*:*:*:*:*

drupal

Version:

7.44

CPE:

cpe:2.3:a:drupal:drupal:7.44:*:*:*:*:*:*:*

drupal

Version:

7.51

CPE:

cpe:2.3:a:drupal:drupal:7.51:*:*:*:*:*:*:*

drupal

Version:

7.23

CPE:

cpe:2.3:a:drupal:drupal:7.23:*:*:*:*:*:*:*

drupal

Version:

7.35

CPE:

cpe:2.3:a:drupal:drupal:7.35:*:*:*:*:*:*:*

drupal

Version:

8.4.1

CPE:

cpe:2.3:a:drupal:drupal:8.4.1:*:*:*:*:*:*:*

drupal

Version:

7.56

CPE:

cpe:2.3:a:drupal:drupal:7.56:*:*:*:*:*:*:*

drupal

Version:

7.8

CPE:

cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:*

drupal

Version:

7.43

CPE:

cpe:2.3:a:drupal:drupal:7.43:*:*:*:*:*:*:*

drupal

Version:

7.7

CPE:

cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:*

drupal

Version:

7.36

CPE:

cpe:2.3:a:drupal:drupal:7.36:*:*:*:*:*:*:*

drupal

Version:

7.10

CPE:

cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:*

drupal

Version:

7.33

CPE:

cpe:2.3:a:drupal:drupal:7.33:*:*:*:*:*:*:*

drupal

Version:

7.52

CPE:

cpe:2.3:a:drupal:drupal:7.52:*:*:*:*:*:*:*

drupal

Version:

7.2

CPE:

cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:*

drupal

Version:

7.39

CPE:

cpe:2.3:a:drupal:drupal:7.39:*:*:*:*:*:*:*

drupal

Version:

7.29

CPE:

cpe:2.3:a:drupal:drupal:7.29:*:*:*:*:*:*:*

drupal

Version:

7.54

CPE:

cpe:2.3:a:drupal:drupal:7.54:*:*:*:*:*:*:*

drupal

Version:

7.15

CPE:

cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:*

drupal

Version:

7.22

CPE:

cpe:2.3:a:drupal:drupal:7.22:*:*:*:*:*:*:*

drupal

Version:

7.25

CPE:

cpe:2.3:a:drupal:drupal:7.25:*:*:*:*:*:*:*

drupal

Version:

7.34

CPE:

cpe:2.3:a:drupal:drupal:7.34:*:*:*:*:*:*:*

drupal

Version:

7.28

CPE:

cpe:2.3:a:drupal:drupal:7.28:*:*:*:*:*:*:*

drupal

Version:

7.16

CPE:

cpe:2.3:a:drupal:drupal:7.16:*:*:*:*:*:*:*

drupal

Version:

7.1

CPE:

cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:*

drupal

Version:

7.30

CPE:

cpe:2.3:a:drupal:drupal:7.30:*:*:*:*:*:*:*

drupal

Version:

7.13

CPE:

cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:*

drupal

Version:

7.14

CPE:

cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:*

drupal

Version:

7.31

CPE:

cpe:2.3:a:drupal:drupal:7.31:*:*:*:*:*:*:*

drupal

Version:

7.37

CPE:

cpe:2.3:a:drupal:drupal:7.37:*:*:*:*:*:*:*

drupal

Version:

7.17

CPE:

cpe:2.3:a:drupal:drupal:7.17:*:*:*:*:*:*:*

drupal

Version:

7.19

CPE:

cpe:2.3:a:drupal:drupal:7.19:*:*:*:*:*:*:*

drupal

Version:

7.12

CPE:

cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:*

drupal

Version:

7.55

CPE:

cpe:2.3:a:drupal:drupal:7.55:*:*:*:*:*:*:*

drupal

Version:

7.20

CPE:

cpe:2.3:a:drupal:drupal:7.20:*:*:*:*:*:*:*

drupal

Version:

7.18

CPE:

cpe:2.3:a:drupal:drupal:7.18:*:*:*:*:*:*:*

drupal

Version:

8.4.4

CPE:

cpe:2.3:a:drupal:drupal:8.4.4:*:*:*:*:*:*:*

drupal

Version:

7.40

CPE:

cpe:2.3:a:drupal:drupal:7.40:*:*:*:*:*:*:*

drupal

Version:

8.4.0

CPE:

cpe:2.3:a:drupal:drupal:8.4.0:-:*:*:*:*:*:*

drupal

Version:

7.6

CPE:

cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:*

This vulnerability affects 60 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-79 Top 25 #1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Exploit Likelihood: High
Typical Severity: Medium
OWASP Top 10: A03:2021-Injection
Abstraction Level: Base