What is GHSA-cmmh-8mwp-gq5p?

GHSA-cmmh-8mwp-gq5p is a security advisory published by GitHub Security Advisories with Medium severity. Drupal Cross Site Scripting (XSS) vulnerability

Which CVE IDs does GHSA-cmmh-8mwp-gq5p cover?

GHSA-cmmh-8mwp-gq5p covers the following CVE IDs: CVE-2019-6341. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cmmh-8mwp-gq5p?

GHSA-cmmh-8mwp-gq5p has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-cmmh-8mwp-gq5p?

GHSA-cmmh-8mwp-gq5p affects 6 products, including: composer/drupal/core:\u003e= 7.0.0, \u003c 7.65.0; composer/drupal/core:\u003e= 8.0.0, \u003c 8.5.14; composer/drupal/core:\u003e= 8.6.0, \u003c 8.6.13; composer/drupal/drupal:\u003e= 7.0.0, \u003c 7.65.0; composer/drupal/drupal:\u003e= 8.0.0, \u003c 8.5.14; and others — see the full list on the advisory page.

GHSA-cmmh-8mwp-gq5pMediumCVSS 5.4

Drupal Cross Site Scripting (XSS) vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

April 23, 2024

🔗 CVE IDs covered (1)

CVE-2019-6341 →

📋 Description

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

🎯 Affected products6

composer/drupal/core:>= 7.0.0, < 7.65.0
composer/drupal/core:>= 8.0.0, < 8.5.14
composer/drupal/core:>= 8.6.0, < 8.6.13
composer/drupal/drupal:>= 7.0.0, < 7.65.0
composer/drupal/drupal:>= 8.0.0, < 8.5.14
composer/drupal/drupal:>= 8.6.0, < 8.6.13

🔗 References (15)

https://nvd.nist.gov/vuln/detail/CVE-2019-6341
https://lists.debian.org/debian-lts-announce/2019/04/msg00003.html
https://lists.fedoraproject.org/archives/list/[email protected]/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7/
https://lists.fedoraproject.org/archives/list/[email protected]/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYX/
https://lists.fedoraproject.org/archives/list/[email protected]/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4P/
https://lists.fedoraproject.org/archives/list/[email protected]/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFS/
https://www.drupal.org/sa-core-2019-004
https://www.synology.com/security/advisory/Synology_SA_19_13
https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6341.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6341.yaml
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4P/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFS/
https://github.com/advisories/GHSA-cmmh-8mwp-gq5p