Every CVESearch/Get API key

CVE-2019-6341

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

5.4 MediumFix available

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

12.2%Up 10.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used5.4

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
CVE-2019-6341
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
CVE-2019-6341
Updated
2026-11-02
EUVDEUVD-2022-3597No score

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
EUVD-2022-3597
Updated
2026-11-03
GitHub AdvisoriesGHSA-cmmh-8mwp-gq5p5.4

Drupal Cross Site Scripting (XSS) vulnerability

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
GHSA-cmmh-8mwp-gq5p
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2019-63415.4

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
ALPINE-CVE-2019-6341
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSV5.4

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
CVE-2019-6341
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-cmmh-8mwp-gq5p5.4

Drupal Cross Site Scripting (XSS) vulnerability

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
GHSA-cmmh-8mwp-gq5p
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2019-63415.4

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
UBUNTU-CVE-2019-6341
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDRUPAL-CORE-2019-004No score

Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

Record
DRUPAL-CORE-2019-004
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
7.0.0 up to 7.65.0
7.65.0
drupal/core
Packagist
8.0.0 up to 8.5.14
8.5.14
drupal/core
Packagist
8.6.0 up to 8.6.13
8.6.13
drupal/drupal
Packagist
7.0.0 up to 7.65.0
7.65.0
drupal/drupal
Packagist
8.0.0 up to 8.5.14
8.5.14
drupal/drupal
Packagist
8.6.0 up to 8.6.13
8.6.13
drupal7
Alpine:v3.10
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.11
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.12
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.13
before 7.65-r0
7.65-r0
Show 16 moreShow less
Affected packages
PackageAffectedFixed
drupal7
Alpine:v3.14
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.15
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.16
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.17
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.18
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.19
before 7.65-r0
7.65-r0
drupal7
Alpine:v3.20
before 7.65-r0
7.65-r0
drupal7
Debian:8
before 7.32-1+deb8u16, plus listed versions
7.32-1+deb8u107.32-1+deb8u117.32-1+deb8u127.32-1+deb8u137.32-1+deb8u14
Show 10 moreShow less
7.32-1+deb8u157.32-1+deb8u37.32-1+deb8u47.32-1+deb8u4~bpo70+17.32-1+deb8u57.32-1+deb8u5~bpo70+17.32-1+deb8u67.32-1+deb8u77.32-1+deb8u87.32-1+deb8u9
7.32-1+deb8u16
drupal/core
Packagist
8.0.0 up to 8.5.14, 8.6.0 up to 8.6.13, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
8.5.148.6.13
drupal7
Debian:9
before 7.52-2+deb9u7, plus listed versions
7.52-27.52-2+deb9u17.52-2+deb9u27.52-2+deb9u37.52-2+deb9u47.52-2+deb9u57.52-2+deb9u6
7.52-2+deb9u7
drupal/core
Packagist
8.0.0 up to 8.5.14, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
8.5.14
drupal/core
Packagist
8.6.0 up to 8.6.13, plus listed versions
8.6.18.6.108.6.118.6.128.6.2
Show 7 moreShow less
8.6.38.6.48.6.58.6.68.6.78.6.88.6.9
8.6.13
drupal/drupal
Packagist
8.0.0 up to 8.5.14, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1
8.5.14
drupal/drupal
Packagist
8.6.0 up to 8.6.13, plus listed versions
8.6.18.6.108.6.118.6.128.6.2
Show 7 moreShow less
8.6.38.6.48.6.58.6.68.6.78.6.88.6.9
8.6.13
drupal7
Ubuntu:Pro:14.04:LTS
All versions, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3
None known
drupal7
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3
None known

History

History
RecordedChangedSources
facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-6341 is a medium vulnerability (CVSS 5.4) in Drupal, published March 20, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.2%, the 96th percentile. Fixed in drupal/core 7.65.0.

References

Show 14 moreShow less
This page doesn't list everything

Left out here: 96 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open