Drupal Cross-Site Scripting Vulnerability in drupal/core
Summary
CVE-2017-6929: Drupal cross site scripting vulnerability. Affects drupal/core across 2 version ranges.
>= 7.0, < 7.57
>= 8.0, < 8.4.0
Fixed in 7.57 or 8.4.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It is widely used for building websites and applications. The drupal/core package is a fundamental component of Drupal that provides core functionality and features. This package is vulnerable to a cross-site scripting (XSS) vulnerability when making Ajax requests to untrusted domains.
Vulnerability Detail
The vulnerability arises due to a jQuery XSS vulnerability that can be exploited when using contributed or custom modules. It is important to note that this vulnerability has already been fixed in Drupal 8.4.0 for Drupal 8 and in the current release (Drupal 7.57) for Drupal 7. The vulnerability is mitigated by the upgrade to jQuery 3 in Drupal 8.4.0 and the fix for jQuery 1.4.4 (the version that ships with Drupal 7 core) in Drupal 7.57. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.577.57composer require drupal/core:7.57 -
>= 8.0, < 8.4.08.4.0composer require drupal/core:8.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to apply the available updates as mentioned in the 'how_to_fix' section.
Conclusion
The Drupal core package is vulnerable to a cross-site scripting (XSS) vulnerability when making Ajax requests to untrusted domains. It is crucial to update to the latest version of Drupal 8 or Drupal 7, depending on your installation, to mitigate this vulnerability. Keeping all contributed and custom modules up to date is also important to ensure the overall security of your Drupal application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and applications.
The drupal/core package is a fundamental component of Drupal that provides core functionality and features.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Drupal installation is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for vulnerabilities.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
