CVE-2019-6341

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Affected

Drupal · Drupal core

CVSS v3.0 NVD

5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

12.19% chance of exploitation in the next 30 days, 96th percentile

Published

2019-03-26

Updated

2024-08-04

Vulhub environments (1)

• vulhub/vulhub/tree/master/drupal/CVE-2019-6341

Security advisories

• https://www.drupal.org/sa-core-2019-004
• https://lists.debian.org/debian-lts-announce/2019/04/msg00003.html
• advisories/GHSA-cmmh-8mwp-gq5p

References

• CVE Record
• NVD entry