{"schemaVersion":3,"id":"CVE-2017-6927","aliases":["UBUNTU-CVE-2017-6927"],"status":"published","duplicateOf":null,"title":null,"description":"Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.","dates":{"published":"2018-03-01T22:00:00.000Z","modified":"2024-09-17T00:51:53.420Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":6.1,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true}]},"epss":{"probability":0.01606,"percentile":0.75537,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01606},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01613,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01613,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01613,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01822,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01606,"percentile":0.75537}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01822,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01606,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01606,"percentile":0.75537}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"ubuntu","product":"drupal7","name":"drupal7","label":"drupal7","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/drupal7","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0 | 8.0 | 9.0","eol":{"isEol":true,"eolDate":"2018-05-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7","label":"7 (Wheezy)","eolFrom":"2018-05-31T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"7.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"drupal","product":"drupal","name":"drupal","label":"drupal","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0, < 7.57","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.0, < 8.4.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0, < 7.57 | ≥ 8.4.0, < 8.4.5","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"drupal","label":"Drupal","category":"server-app"}},"hubHref":"/vendor/drupal/drupal"},{"vendor":"drupal.org","product":"drupal core","name":"Drupal Core","label":"drupal core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57","eol":null,"hubHref":"/vendor/drupalorg/drupal_core"}],"affectedCount":4,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://www.debian.org/security/2018/dsa-4123","label":"www.debian.org/security/2018/dsa-4123","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","label":"lists.debian.org/debian-lts-announce/2018/02/msg00030.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/103138","label":"www.securityfocus.com/bid/103138","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://www.drupal.org/sa-core-2018-001","label":"www.drupal.org/sa-core-2018-001","hostname":"www.drupal.org","tags":["X Refsource CONFIRM","Vendor Advisory","REPORT"]},{"url":"https://ubuntu.com/security/CVE-2017-6927","label":"ubuntu.com/security/CVE-2017-6927","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6927","label":"www.cve.org/CVERecord?id=CVE-2017-6927","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":["DLA-1295-1","DSA-4123-1"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-03-01T22:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-17T00:51:53.420Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:46:03.631Z","stale":false,"partial":false}}