GitStock

drupal/core · Security

Drupal Cross Site Scripting (XSS) vulnerability

GHSA ID
GHSA-cmmh-8mwp-gq5p
CVE ID
CVE-2019-6341
Severity
medium
Published
Updated
CVSS
5.4 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v3
5.4 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

Open GitHub