Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 497914920385b7016ac9c9367e0198530787adf2 to before bc929eb17c4f4eea83cb796b7c5bbb984bf288bd | bc929eb17c4f4eea83cb796b7c5bbb984bf288bd |
| abfe77673a5a6194ef13600e05f1ca2c5dd59db8 to before 3347ff569787d2e659a8c4b5211ea0c76894aa8a | 3347ff569787d2e659a8c4b5211ea0c76894aa8a |
Also listed as affected (31)
| |
Description
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.