Drupal Core Cross-Site Scripting (XSS)

MITTEL 5.4CVE-2024-12393 · BIT-drupal-2024-12393 · DRUPAL-CORE-2024-003 · Published 10/12/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-12393 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in drupal/core, drupal/core-recommended, drupal/drupal.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.34%, höher als bei 27.1% aller Schwachstellen.
Abhilfe: auf 10.3.9, 11.0.8, 10.2.11 oder neuer aktualisieren.

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`
drupal/core-recommended Packagist	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`
drupal/drupal Packagist	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`
drupal drupal	`≥ 10.3.0, < 10.3.9≥ 11.0.0, < 11.0.8≥ 8.8.0, < 10.2.11`	`10.3.911.0.810.2.11`

Description

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

NVD description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.