CVE-2024-12393: Drupal Core Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2024-12393: Drupal Core Cross-Site Scripting (XSS). Affects drupal/core across 3 version ranges.
>= 8.8.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fixed in 10.2.11, 10.3.9 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2024-12393 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and extensive community support. However, like any software, Drupal can be vulnerable to security issues. This specific vulnerability relates to how Drupal handles status messages, which can lead to cross-site scripting (XSS) attacks if not properly sanitized.
Vulnerability Detail
The vulnerability arises from the use of JavaScript to render status messages in certain configurations of Drupal. In specific scenarios, these messages are not adequately sanitized, allowing an attacker to inject malicious scripts. This can lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities. The affected versions of Drupal Core include those from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 10.2.1110.2.11composer require drupal/core:10.2.11 -
>= 10.3.0, < 10.3.910.3.9composer require drupal/core:10.3.9 -
>= 11.0.0, < 11.0.811.0.8composer require drupal/core:11.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update to a patched version, consider disabling JavaScript rendering for status messages as a temporary workaround. This can be done by modifying the relevant configuration settings in your Drupal installation.
Conclusion
The CVE-2024-12393 vulnerability in Drupal Core highlights the importance of keeping software updated and properly sanitizing user inputs. By following the recommended steps to update your installation, you can protect your site from potential XSS attacks.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2024-12393 is a vulnerability in Drupal Core that allows for cross-site scripting (XSS) due to improper sanitization of status messages.
You can check your Drupal version against the affected versions listed in the vulnerability details. Additionally, you can use Vulert to monitor and alert for vulnerabilities in your software.
The risks include potential data theft, unauthorized actions performed on behalf of users, and other malicious activities that could compromise the integrity of your website.
Yes, you can disable JavaScript rendering for status messages as a temporary workaround until you can apply the patch.
Vulert uses your composer.lock file to monitor and alert in real-time for open-source vulnerabilities in your software, providing an easy way to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
