{"action":"Upgrade drupal/drupal to 8.5.15 or later.","affected":[{"fixed":"8.5.15","introduced":"8.0.0"},{"fixed":"8.6.15","introduced":"8.6.0"}],"component":"drupal/drupal","cve_ids":["CVE-2019-10909"],"ecosystem":"Packagist","epss":0.01029,"exploited":false,"fixed_versions":["8.5.15","8.6.15"],"ghsa_id":"GHSA-g996-q5r8-w7g2","id":"tcs_01M5KF2JCWABYMSSVG541XR5Q5","modified_at":"2024-02-16T08:21:49.261419Z","published_at":"2019-11-12T23:00:53Z","references":["https://osv.dev/vulnerability/GHSA-g996-q5r8-w7g2","https://nvd.nist.gov/vuln/detail/CVE-2019-10909","https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml","https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine","https://symfony.com/cve-2019-10909","https://www.drupal.org/sa-core-2019-005","https://www.synology.com/security/advisory/Synology_SA_19_19"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-g996-q5r8-w7g2#Packagist/drupal/drupal","url":"https://osv.dev/vulnerability/GHSA-g996-q5r8-w7g2"}],"summary":"Symfony Cross-site Scripting (XSS) vulnerability"}