Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-12393

Fixed upstream EPSS <1%CVSS 5.4

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Published 2024-12-09 · CVE record · OSV

Products: Drupal Core

Fixed upstream

EcosystemPackageFixed in
Packagistdrupal/core10.2.11
Packagistdrupal/core10.3.9
Packagistdrupal/core11.0.8
Packagistdrupal/core-recommended10.2.11
Packagistdrupal/core-recommended10.3.9
Packagistdrupal/core-recommended11.0.8
Packagistdrupal/drupal10.2.11
Packagistdrupal/drupal10.3.9
Packagistdrupal/drupal11.0.8

Distro releases

ReleasePackageFixed in
Ubuntu Pro 14.04 LTSdrupal7no fix
Ubuntu Pro 16.04 LTSdrupal7no fix