{"id":"CVE-2024-13305","aliases":["DRUPAL-CONTRIB-2024-071","EUVD-2024-51518","GHSA-9j33-5mgw-847x"],"status":"published","title":"Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00243,"percentile":0.15578,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-12-04T16:20:57Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_form_steps","fixed_in":["1.1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_form_steps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4"}]}]}],"products":[{"vendor":"drupal","product":"entity form steps"},{"vendor":"imagexmedia","product":"entity_form_steps"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-071","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13305","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9j33-5mgw-847x"},{"url":"https://git.drupalcode.org/project/entity_form_steps","tags":["web"]},{"url":"https://www.drupal.org/project/entity_form_steps","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13305.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13305","title":"Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.","status":"published","published":"2025-01-09T20:25:32.4Z","modified":"2025-01-10T16:14:21.172Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-51518","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.","status":"published","published":"2025-01-09T20:25:32Z","modified":"2025-01-10T16:14:21Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-9j33-5mgw-847x","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.","status":"published","published":"2025-01-09T21:31:32Z","modified":"2025-01-10T18:32:46Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13305","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.","status":"published","published":"2025-01-09T21:15:28.5Z","modified":"2026-06-17T07:01:44.383Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:42.329342Z"}],"osv":[{"id":"CVE-2024-13305","title":"Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.","status":"published","published":"2025-01-09T20:25:32.4Z","modified":"2026-10-28T02:30:32.64188742Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-071","description":"This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins.\n\nThe module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the 'administer [entity\\_type] form display' permission allowing access to configure entity form displays.","status":"published","published":"2024-12-04T16:20:57Z","modified":"2026-09-10T03:45:43.745375895Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}