Bug 1693078 (CVE-2019-6341) - CVE-2019-6341 drupal7: cross-site scripting vulnerability in module/subsystem
Summary: CVE-2019-6341 drupal7: cross-site scripting vulnerability in module/subsystem
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-6341
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1693079 1693080 1693081
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-27 06:45 UTC by Dhananjay Arunesh
Modified: 2021-02-16 22:11 UTC (History)
4 users (show)

Fixed In Version: Drupal 8.6.13, Drupal 8.5.14, Drupal 7.65
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-05-16 06:38:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-03-27 06:45:15 UTC 
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Reference:
https://www.drupal.org/sa-core-2019-004
Comment 1 Dhananjay Arunesh 2019-03-27 06:46:41 UTC 
Created drupal7 tracking bugs for this issue:

Affects: fedora-all [bug 1693079]


Created drupal8 tracking bugs for this issue:

Affects: fedora-all [bug 1693080]
Comment 2 Dhananjay Arunesh 2019-03-27 06:47:12 UTC 
Created drupal7 tracking bugs for this issue:

Affects: epel-all [bug 1693081]
Comment 3 Dhananjay Arunesh 2019-03-27 06:48:52 UTC 
External References:

https://www.drupal.org/sa-core-2019-004
Comment 4 Shawn Iwinski 2019-05-15 14:19:32 UTC 
All dependent bugs are closed, can this tracking bug be closed as well please?
Note You need to log in before you can comment on or make changes to this bug.