tocsin

Packagist/drupal/core CVE-2019-6341: unknown, EPSS 12.19%

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Action: Upgrade drupal/core to 8.5.14 or later.

composer require drupal/core:8.5.14
composer require drupal/core:8.6.13

Affected

introducedfixedlast affected
8.0.08.5.14-
8.6.08.6.13-

Fixed versions

8.5.148.6.13

Sources

CVE-2019-6341 · published · modified · JSON