{"id":"CVE-2019-6341","details":"In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.","aliases":["DRUPAL-CORE-2019-004","GHSA-cmmh-8mwp-gq5p"],"modified":"2026-07-08T05:55:06.997437211Z","published":"2019-03-26T18:29:01.027Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"28"},{"last_affected":"28"},{"introduced":"29"},{"last_affected":"29"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYX/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4P/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFS/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00003.html"},{"type":"ADVISORY","url":"https://www.synology.com/security/advisory/Synology_SA_19_13"},{"type":"FIX","url":"https://www.drupal.org/sa-core-2019-004"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/drupal/drupal","events":[{"introduced":"497914920385b7016ac9c9367e0198530787adf2"},{"fixed":"c2cae51e5c32296f6129edb0bc08d5d2b38b92c9"},{"introduced":"b73ab73d39dca97a12513e8a9e4f4da4b0676f5f"},{"fixed":"471af00dd8660843b8fe3108b8b74d92013b4804"},{"introduced":"9b04d294324d9c76be4b596de4316cb8804e8223"},{"fixed":"89e23ccafb25162c4bc82c0a2d05bc03e4b59ddd"}],"database_specific":{"extracted_events":[{"introduced":"7.0"},{"fixed":"7.65"},{"introduced":"8.5.0"},{"fixed":"8.5.14"},{"introduced":"8.6.0"},{"fixed":"8.6.13"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"}}],"versions":["7.64","8.5.13","8.6.12","8.5.12","8.6.11","8.6.9","8.6.8","7.61","8.6.5","8.6.4","8.6.3","8.6.1","8.5.7","8.6.0","8.5.5","8.5.4","8.5.0","7.56","7.55","7.54","7.51","7.50","7.43","7.42","7.40","7.37","7.36","7.33","7.30","7.28","7.25","7.23","7.22","7.17","7.15","7.14","7.12","7.10","7.9","7.8","7.7","7.6","7.4","7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6341.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}