GitHub Advisoryadvisory · Packagist

GHSA-5vpr-v24w-mmjj Drupal cross site scripting vulnerability

MEDIUM Published 2022-05-14 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-6929
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 7.0, < 7.57 → fixed in 7.57 • Packagist drupal/core: >= 8.0, < 8.4.0 → fixed in 8.4.0 • Packagist drupal/drupal: >= 8.0, < 8.4.0 → fixed in 8.4.0 • Packagist drupal/drupal: >= 7.0, < 7.57 → fixed in 7.57

Description

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module.

Related

Alias · CVE (1)

  • CVE-2017-6929 A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References