~ / search / GHSA-cmmh-8mwp-gq5p

GHSA-cmmh-8mwp-gq5p

Drupal Cross Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-6341

Packages

EcosystemPackageAffectedFixed in
Packagist drupal/core >= 7.0.0, < 7.65.0 7.65.0
Packagist drupal/core >= 8.0.0, < 8.5.14 8.5.14
Packagist drupal/core >= 8.6.0, < 8.6.13 8.6.13
Packagist drupal/drupal >= 7.0.0, < 7.65.0 7.65.0
Packagist drupal/drupal >= 8.0.0, < 8.5.14 8.5.14
Packagist drupal/drupal >= 8.6.0, < 8.6.13 8.6.13

Details

As written in the advisory (Markdown source, shown as plain text).

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File `module/subsystem` allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

References

External links from the advisory. They lead to third-party sites.