CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6926
https://notcve.org/view.php?id=CVE-2017-6926
In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments. En las versiones 8.4.x de Drupal anteriores a la 8.4.5, los usuarios con permisos para publicar comentarios pueden ver contenido y comentarios a los que no tienen acceso y, además, también pueden añadir comentarios en estos contenidos. Esta vulnerabilidad se mitiga por el hecho de que el sistema de comentarios debe estar activado y el atacante debe tener permiso para publicar comentarios. • https://www.drupal.org/sa-core-2018-001 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6931
https://notcve.org/view.php?id=CVE-2017-6931
In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module. En las versiones 8.4.x de Drupal anteriores a la 8.4.5, el módulo Settings Tray tiene una vulnerabilidad que permite que los usuarios actualicen ciertos datos para los que no tienen permisos. • https://www.drupal.org/sa-core-2018-001 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-6927
https://notcve.org/view.php?id=CVE-2017-6927
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected. Las versiones 8.4.x de Drupal anteriores a la 8.4.5 y las versiones 7.x anteriores a la 7.57 tienen una función de JavaScript Drupal.checkPlain() que se emplea para escapar texto potencialmente peligroso antes de extraerlo como HTML (ya que la exportación JavaScript no suele pasar un proceso de autoescape Twig). Esta función no gestiona adecuadamente todos los métodos de inyección de HTML malicioso, lo que conduce a una vulnerabilidad de Cross-Site Scripting (XSS) en ciertas circunstancias. • http://www.securityfocus.com/bid/103138 https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html https://www.debian.org/security/2018/dsa-4123 https://www.drupal.org/sa-core-2018-001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-6929
https://notcve.org/view.php?id=CVE-2017-6929
A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module. Hay una vulnerabilidad de Cross-Site Scripting (XSS) jQuery cuando se realizan peticiones Ajax a dominios no fiables. • https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html https://www.debian.org/security/2018/dsa-4123 https://www.drupal.org/sa-core-2018-001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6930
https://notcve.org/view.php?id=CVE-2017-6930
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records(). En las versiones 8.4.x de Drupal anteriores a la 8.4.5, al emplear controles de acceso a nodos con un sitio multilingüe, Drupal marca la versión sin traducir de un nodo como la reserva por defecto para consultas de acceso. • https://www.drupal.org/sa-core-2018-001 •