Medium severity5.4NVD Advisory· Published Mar 26, 2019· Updated Jun 17, 2026
CVE-2019-6341
CVE-2019-6341
Description
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
drupal/corePackagist | >= 7.0.0, < 7.65.0 | 7.65.0 |
drupal/corePackagist | >= 8.0.0, < 8.5.14 | 8.5.14 |
drupal/corePackagist | >= 8.6.0, < 8.6.13 | 8.6.13 |
drupal/drupalPackagist | >= 7.0.0, < 7.65.0 | 7.65.0 |
drupal/drupalPackagist | >= 8.0.0, < 8.5.14 | 8.5.14 |
drupal/drupalPackagist | >= 8.6.0, < 8.6.13 | 8.6.13 |
Affected products
7cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
- ghsa-coords2 versions
>= 7.0.0, < 7.65.0+ 1 more
- (no CPE)range: >= 7.0.0, < 7.65.0
- (no CPE)range: >= 7.0.0, < 7.65.0
- Range: Drupal 7
Patches
Vulnerability mechanics
References
19- www.drupal.org/sa-core-2019-004nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-cmmh-8mwp-gq5pghsaADVISORY
- lists.debian.org/debian-lts-announce/2019/04/msg00003.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2019-6341ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6341.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6341.yamlghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7ghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYXghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4PghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFSghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7ghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYXghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4PghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFSghsaWEB
- www.synology.com/security/advisory/Synology_SA_19_13nvdWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYX/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4P/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFS/nvd
News mentions
0No linked articles in our index yet.