Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: Drupal.org Drupal Core — DSA-4123 Clear all filters
TI-2017-04658 CVE-2017-6932 · GHSA-wm86-w3cf-h6vm

Open redirect in Drupal Core

Priority LOW 24

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used.

CVSS 3.0MEDIUM 4.7 Network No auth User interaction EPSS 0.01174 Published 2018-03-01 Fixed in 7.57 CWE-601
TI-2017-04655 CVE-2017-6929 · GHSA-5vpr-v24w-mmjj

Cross-site scripting in Drupal Core

Priority LOW 30

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01218 Published 2018-03-01 Fixed in 7.57, 8.4.0 CWE-79
TI-2017-04654 CVE-2017-6928 · GHSA-66mv-q8r2-hj8w

Incorrect permission assignment in Drupal Core

Priority LOW 26

Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it.

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0102 Published 2018-03-01 Fixed in 7.57 CWE-732
TI-2017-04653 CVE-2017-6927 · GHSA-585j-5449-mf5m

Cross-site scripting in Drupal Core

Priority LOW 30

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output d…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01606 Published 2018-03-01 Fixed in 8.4.5, 7.57 CWE-79