GitHub Advisoryadvisory · Packagist

GHSA-8mvq-8h2v-j9vf Drupal Core Cross-Site Scripting (XSS)

MEDIUM Published 2024-12-10 Modified 2025-06-04 Official page ↗
Aliases
CVE-2024-12393
Ecosystem
Packagist
Packages
drupal/core, drupal/core-recommended, drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-12-10

Affected packages

• Packagist drupal/core: >= 8.8.0, < 10.2.11 → fixed in 10.2.11 • Packagist drupal/core: >= 10.3.0, < 10.3.9 → fixed in 10.3.9 • Packagist drupal/core: >= 11.0.0, < 11.0.8 → fixed in 11.0.8 • Packagist drupal/core-recommended: >= 8.8.0, < 10.2.11 → fixed in 10.2.11 • Packagist drupal/core-recommended: >= 10.3.0, < 10.3.9 → fixed in 10.3.9 • Packagist drupal/core-recommended: >= 11.0.0, < 11.0.8 → fixed in 11.0.8 • Packagist drupal/drupal: >= 8.8.0, < 10.2.11 → fixed in 10.2.11 • Packagist drupal/drupal: >= 10.3.0, < 10.3.9 → fixed in 10.3.9 • Packagist drupal/drupal: >= 11.0.0, < 11.0.8 → fixed in 11.0.8

Description

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Related

Alias · CVE (1)

  • CVE-2024-12393 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References