Packagist/drupal/drupal CVE-2019-10909: medium 5.4, EPSS 1.03%
Symfony Cross-site Scripting (XSS) vulnerability
Action: Upgrade drupal/drupal to 8.5.15 or later.
composer require drupal/drupal:8.5.15composer require drupal/drupal:8.6.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 8.5.15 | - |
| 8.6.0 | 8.6.15 | - |
Fixed versions
| 8.5.15 | 8.6.15 |
Sources
- osv: GHSA-g996-q5r8-w7g2#Packagist/drupal/drupal
- https://nvd.nist.gov/vuln/detail/CVE-2019-10909
- https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
- https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
- https://symfony.com/cve-2019-10909
- https://www.drupal.org/sa-core-2019-005
- https://www.synology.com/security/advisory/Synology_SA_19_19
CVE-2019-10909 · published · modified · JSON