CVE-2017-6927: debian debian_linux Cross-site Scripting
Vulnerability summary
CVE-2017-6927 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.61% chance of exploitation in the next 30 days, higher than 75.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 01-03-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.61%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
0.00 pp
From 1.61% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- debian_linuxEOL7.0 | 8.0 | 9.0
Drupal1 product
- drupal≥ 7.0, < 7.57 | ≥ 8.4.0, < 8.4.5
Drupal.org1 product
- drupal core8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57
Ubuntu1 product
- drupal7All versions (No fix recorded)
4 vendors · 4 products
References
6 links
- lists.debian.org/debian-lts-announce/2018/02/msg00030.htmlMailing ListX Refsource MLISTThird Party Advisory