Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-q4qx-7s1y-q3hc
Vulnerability ID VCID-q4qx-7s1y-q3hc
Aliases CVE-2024-12393
GHSA-8mvq-8h2v-j9vf
Summary Drupal Core Cross-Site Scripting (XSS) Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
epss 0.01889 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8mvq-8h2v-j9vf
cvssv3.1 5.4 https://github.com/drupal/core
cvssv4 5.3 https://github.com/drupal/core
generic_textual MODERATE https://github.com/drupal/core
cvssv3.1 5.4 https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
cvssv4 5.3 https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
generic_textual MODERATE https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2024-12393
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-12393
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-12393
cvssv3.1 5.4 https://www.drupal.org/sa-core-2024-003
cvssv4 5.3 https://www.drupal.org/sa-core-2024-003
generic_textual MODERATE https://www.drupal.org/sa-core-2024-003
ssvc Track https://www.drupal.org/sa-core-2024-003
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-12393
https://github.com/drupal/core
https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
https://nvd.nist.gov/vuln/detail/CVE-2024-12393
https://www.drupal.org/sa-core-2024-003
GHSA-8mvq-8h2v-j9vf https://github.com/advisories/GHSA-8mvq-8h2v-j9vf
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/drupal/core
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/drupal/core
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-12393
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-12393
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.drupal.org/sa-core-2024-003
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://www.drupal.org/sa-core-2024-003
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:36:16Z/ Found at https://www.drupal.org/sa-core-2024-003
Exploit Prediction Scoring System (EPSS)
Percentile 0.83129
EPSS Score 0.01889
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:50:12.744234+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-8mvq-8h2v-j9vf/GHSA-8mvq-8h2v-j9vf.json 38.0.0