CVE-2024-12393: Drupal Core - Cross-Site Scripting Vulnerability
Summary
CVE-2024-12393: Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003. Affects drupal across 2 version ranges.
>= 8.8.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fixed in 10.3.9 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2024-12393 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility, scalability, and extensive community support. However, like any software, it can be vulnerable to security issues. The specific vulnerability in question allows for Cross-Site Scripting (XSS), which can lead to unauthorized actions being performed on behalf of users.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, including data theft, session hijacking, and unauthorized actions performed on behalf of users. The affected versions of Drupal Core include those from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 10.3.910.3.9 -
>= 11.0.0, < 11.0.811.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update, consider restricting user input in forms and sanitizing output to mitigate the risk of XSS attacks. Additionally, review user permissions to limit access to sensitive areas of your site.
Conclusion
The Cross-Site Scripting vulnerability in Drupal Core (CVE-2024-12393) poses a significant risk to users and their data. It is crucial to update to the latest patched versions to safeguard against potential exploits. Regular monitoring and proactive security measures can help maintain the integrity of your Drupal site.
See every vulnerability recorded for drupal →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and session integrity.
You can check your Drupal version against the affected versions listed in the vulnerability report. Additionally, you can use tools like Vulert to monitor and alert for vulnerabilities in your software.
Failure to address this vulnerability can lead to unauthorized access, data breaches, and damage to your site's reputation, as attackers may exploit the XSS vulnerability to perform malicious actions.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application against vulnerabilities using the Vulert playground.
If an immediate update is not possible, implement input restrictions and output sanitization as a temporary measure to reduce the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
