Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1693078 (CVE-2019-6341) - CVE-2019-6341 drupal7: cross-site scripting vulnerability in module/subsystem
Summary: CVE-2019-6341 drupal7: cross-site scripting vulnerability in module/subsystem
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-6341
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1693079 1693080 1693081
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-27 06:45 UTC by Dhananjay Arunesh
Modified: 2021-02-16 22:11 UTC (History)
4 users (show)

Fixed In Version: Drupal 8.6.13, Drupal 8.5.14, Drupal 7.65
Clone Of:
Environment:
Last Closed: 2019-05-16 06:38:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-03-27 06:45:15 UTC 
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Reference:
https://www.drupal.org/sa-core-2019-004
Comment 1 Dhananjay Arunesh 2019-03-27 06:46:41 UTC 
Created drupal7 tracking bugs for this issue:

Affects: fedora-all [bug 1693079]


Created drupal8 tracking bugs for this issue:

Affects: fedora-all [bug 1693080]
Comment 2 Dhananjay Arunesh 2019-03-27 06:47:12 UTC 
Created drupal7 tracking bugs for this issue:

Affects: epel-all [bug 1693081]
Comment 3 Dhananjay Arunesh 2019-03-27 06:48:52 UTC 
External References:

https://www.drupal.org/sa-core-2019-004
Comment 4 Shawn Iwinski 2019-05-15 14:19:32 UTC 
All dependent bugs are closed, can this tracking bug be closed as well please?
Note You need to log in before you can comment on or make changes to this bug.