Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

Summary

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Timeline

1. Mar 26, 2019, 6:04 PM UTCCVE published
2. Aug 4, 2024, 8:23 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Drupal Drupal core

  From Drupal 7 · fixed in 7.65; From Drupal 8.6 · fixed in 8.6.13; From Drupal 8.5 · fixed in 8.5.14

• drupal/corePackagist

  From 7.0.0 · fixed in 7.65.0

• drupal/corePackagist

  From 8.0.0 · fixed in 8.5.14

• drupal/corePackagist

  From 8.6.0 · fixed in 8.6.13

• drupal/drupalPackagist

  From 7.0.0 · fixed in 7.65.0

• drupal/drupalPackagist

  From 8.0.0 · fixed in 8.5.14

• drupal/drupalPackagist

  From 8.6.0 · fixed in 8.6.13

• drupal/corePackagist

  From 8.0.0 · fixed in 8.5.14; From 8.6.0 · fixed in 8.6.13

References 7