{"id":"CVE-2024-13237","summary":"File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001","details":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38.","modified":"2026-08-12T03:51:30.086601700Z","published":"2025-01-09T18:15:23.691Z","database_specific":{"cna_assigner":"drupal","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13237.json"},"references":[{"type":"WEB","url":"https://git.drupalcode.org/project/file_entity"},{"type":"WEB","url":"https://www.drupal.org/project/file_entity"},{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2024-001"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13237.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13237"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.drupalcode.org/project/file_entity","events":[{"introduced":"0"},{"fixed":"97f8db7ff3a4839232188313b8b32ecd2f5ad357"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"7.x-*"},{"fixed":"7.x-2.38"}]}}],"versions":["7.x-2.37","7.x-2.36","7.x-2.35","7.x-2.34","7.x-2.33","7.x-2.32","7.x-2.30","7.x-2.29","7.x-2.28","7.x-2.27","7.x-2.26","7.x-2.25","7.x-2.24","7.x-2.23","7.x-2.22","7.x-2.21","7.x-2.20","7.x-2.19","7.x-2.18","7.x-2.17","7.x-2.16","7.x-2.15","7.x-2.14","7.x-2.12","7.x-2.11","7.x-2.10","7.x-2.9","7.x-2.8","7.x-2.7","7.x-2.6","7.x-2.5","7.x-2.4","7.x-2.3","7.x-2.2","7.x-2.1","7.x-2.0","7.x-2.0-beta4","7.x-2.0-beta3","7.x-2.0-beta2","7.x-2.0-beta1","7.x-2.0-alpha3","7.x-2.0-alpha2","7.x-2.0-alpha1","7.x-2.0-unstable7","7.x-2.0-unstable6","7.x-2.0-unstable5","7.x-2.0-unstable4","7.x-2.0-unstable3","7.x-2.0-unstable2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13237.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}