Every CVE Search/ Get API key

CVE-2024-12393

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

5.4 MediumFix available

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.34%Up 0.3 points since Dec 10, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.4

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
CVE-2024-12393
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-3449 5.4

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
EUVD-2024-3449
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-8mvq-8h2v-j9vf 5.3

Drupal Core Cross-Site Scripting (XSS)

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
GHSA-8mvq-8h2v-j9vf
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02
NVD 5.4

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
CVE-2024-12393
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
CVE-2024-12393
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-8mvq-8h2v-j9vf 5.3

Drupal Core Cross-Site Scripting (XSS)

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
GHSA-8mvq-8h2v-j9vf
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2024-12393 5.4

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
UBUNTU-CVE-2024-12393
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-drupal-2024-12393 No score

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
BIT-drupal-2024-12393
Updated
2026-11-02
OSVCLSA-2026-1776214337 No score

TuxCare security update for drupal/core (11 CVEs)

TuxCare rebuilt drupal/core to address 11 CVEs. Fixed in 9.5.11-p1+tuxcare.

Record
CLSA-2026-1776214337
Updated
2026-11-02
OSVCLSA-2026-1784682869 No score

TuxCare security update for drupal/core (21 CVEs)

TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.

Record
CLSA-2026-1784682869
Updated
2026-11-02
OSVDRUPAL-CORE-2024-003 No score

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized.

Record
DRUPAL-CORE-2024-003
Updated
2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
 8.0.0 up to 10.1.8
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2
10.2.2
drupal/core
Packagist
 8.8.0 up to 10.2.11
10.2.11
drupal/core
Packagist
 10.3.0 up to 10.3.9
10.3.9
drupal/core
Packagist
 11.0.0 up to 11.0.8
11.0.8
drupal/core-recommended
Packagist
 8.8.0 up to 10.2.11
10.2.11
drupal/core-recommended
Packagist
 10.3.0 up to 10.3.9
10.3.9
drupal/core-recommended
Packagist
 11.0.0 up to 11.0.8
11.0.8
drupal/drupal
Packagist
 8.8.0 up to 10.2.11
10.2.11
drupal/drupal
Packagist
 10.3.0 up to 10.3.9
10.3.9
Show 18 moreShow less
Affected packages
PackageAffectedFixed
drupal/drupal
Packagist
 11.0.0 up to 11.0.8
11.0.8
drupal
Bitnami
 8.8.0 up to 10.3.9, 11.0.0 up to 11.0.8
10.3.911.0.8
drupal/core
TuxCare:Packagist
From an advisory covering 10 CVEs
 9.5.11 up to 9.5.11-p1+tuxcare
9.5.11-p1+tuxcare
drupal/core
TuxCare:Packagist
From an advisory covering 20 CVEs
 8.9.20 up to 8.9.20-p1+tuxcare
8.9.20-p1+tuxcare
drupal/core
Packagist
 8.8.0 up to 10.2.11, 10.3.0 up to 10.3.9, 11.0.0 up to 11.0.8, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.1110.3.911.0.8
drupal/core
Packagist
 8.0.0 up to 10.1.8, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2, plus listed versions
10.2.1
10.2.2
drupal/core
Packagist
 8.8.0 up to 10.2.11, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.11
drupal/core
Packagist
 10.3.0 up to 10.3.9, plus listed versions
10.3.110.3.210.3.310.3.410.3.510.3.610.3.710.3.8
10.3.9
drupal/core
Packagist
 11.0.0 up to 11.0.8, plus listed versions
11.0.111.0.211.0.311.0.411.0.511.0.611.0.7
11.0.8
drupal/core-recommended
Packagist
 8.8.0 up to 10.2.11, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.11
drupal/core-recommended
Packagist
 10.3.0 up to 10.3.9, plus listed versions
10.3.110.3.210.3.310.3.410.3.510.3.610.3.710.3.8
10.3.9
drupal/core-recommended
Packagist
 11.0.0 up to 11.0.8, plus listed versions
11.0.111.0.211.0.311.0.411.0.511.0.611.0.7
11.0.8
drupal/drupal
Packagist
 8.8.0 up to 10.2.11, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.11
drupal/drupal
Packagist
 10.3.0 up to 10.3.9, plus listed versions
10.3.110.3.210.3.310.3.410.3.510.3.610.3.710.3.8
10.3.9
drupal/drupal
Packagist
 11.0.0 up to 11.0.8, plus listed versions
11.0.111.0.211.0.311.0.411.0.511.0.611.0.7
11.0.8
drupal7
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3
 None known
drupal7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-12393 is a medium vulnerability (CVSS 5.4) in Drupal, published February 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in drupal/core 10.1.8.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 977 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open