vulnwire
6.1med

CVE-2017-6929

Drupal cross site scripting vulnerability

Also known as GHSA-5vpr-v24w-mmjj

Published 8 y ago · modified 4 mo ago · JSON

CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 69%
Public exploits
0
none known

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module.

Exploit prediction (EPSS)

1.22% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub3.06.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=7.0, <7.57
>=8.0, <8.4.0
7.57
8.4.0
packagistdrupal/drupal
>=8.0, <8.4.0
>=7.0, <7.57
8.4.0
7.57

Affected products

  • Drupal.org Drupal Core

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • debian.org /security/2018/dsa-4123 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • lists.debian.org /debian-lts-announce/2018/02/msg00030.html · mailing-list, x_refsource_MLIST, x_transferred
  • drupal.org /sa-core-2018-001 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-6929 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6929.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6929.yaml · web
  • github.com /drupal/core · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.