CVE-2019-6341: Drupal Cross Site Scripting (XSS) vulnerability in drupal/core
Summary
CVE-2019-6341: Drupal Cross Site Scripting (XSS) vulnerability. Affects drupal/core across 3 version ranges.
>= 7.0.0, < 7.65.0
>= 8.0.0, < 8.5.14
>= 8.6.0, < 8.6.13
Fixed in 7.65.0, 8.5.14 or 8.6.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The 'drupal/core' package is a fundamental component of Drupal that includes core functionality and modules. This package is susceptible to a Cross Site Scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability exists in Drupal versions prior to 7.65, 8.6.13, and 8.5.14. It is specifically found in the File module/subsystem. Under certain circumstances, a malicious user can upload a file that triggers a cross-site scripting (XSS) vulnerability. This can allow the attacker to inject and execute arbitrary JavaScript code in the context of the affected Drupal site, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.65.07.65.0composer require drupal/core:7.65.0 -
>= 8.0.0, < 8.5.148.5.14composer require drupal/core:8.5.14 -
>= 8.6.0, < 8.6.138.6.13composer require drupal/core:8.6.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patches or upgrade to the fixed versions to ensure the security of the Drupal installation.
Conclusion
The Drupal 'drupal/core' package is vulnerable to a Cross Site Scripting (XSS) vulnerability. It is crucial for site administrators to upgrade to Drupal 7.65, 8.6.13, or 8.5.14 to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications.
The 'drupal/core' package is a fundamental component of Drupal that includes core functionality and modules.
Cross Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Drupal 7.65, 8.6.13, or 8.5.14, depending on the version being used. These versions include patches that address the XSS vulnerability.
There is no known workaround for this vulnerability. It is essential to apply the provided patches or upgrade to the fixed versions to ensure the security of the Drupal installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
