CVE-2017-6929: debian debian_linux Cross-site Scripting
Vulnerability summary
CVE-2017-6929 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 01-03-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.22%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.22% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- debian_linuxEOL7.0 | 8.0 | 9.0
Drupal1 product
- drupal≥ 7.0, < 7.57 | ≥ 8.0.0, < 8.4.0
Drupal.org1 product
- drupal core7.x versions before 7.57
Ubuntu1 product
- drupal7All versions (No fix recorded)
4 vendors · 4 products
References
5 links
- lists.debian.org/debian-lts-announce/2018/02/msg00030.htmlMailing ListX Refsource MLISTIssue Tracking