CVE-2019-6341
Fixed in a distro release EPSS 12%
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
Products: Drupal Core
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | drupal/core | 8.5.14 |
| Packagist | drupal/core | 8.6.13 |
| Packagist | drupal/core | 7.65.0 |
| Packagist | drupal/drupal | 7.65.0 |
| Packagist | drupal/drupal | 8.5.14 |
| Packagist | drupal/drupal | 8.6.13 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 8 | drupal7 | 7.32-1+deb8u16 |
| Debian 9 | drupal7 | 7.52-2+deb9u7 |
| Ubuntu Pro 14.04 LTS | drupal7 | no fix |
| Ubuntu Pro 16.04 LTS | drupal7 | no fix |