Search for vulnerabilities
Vulnerability details: VCID-w7u4-yxfj-hyft
Vulnerability ID VCID-w7u4-yxfj-hyft
Aliases CVE-2024-12393
GHSA-8mvq-8h2v-j9vf
Summary Drupal Core Cross-Site Scripting (XSS) Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-12393
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8mvq-8h2v-j9vf
cvssv3.1 5.4 https://github.com/drupal/core
generic_textual MODERATE https://github.com/drupal/core
cvssv3.1 5.4 https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
generic_textual MODERATE https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2024-12393
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-12393
cvssv3.1 5.4 https://www.drupal.org/sa-core-2024-003
generic_textual MODERATE https://www.drupal.org/sa-core-2024-003
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-12393
https://github.com/drupal/core
https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
https://nvd.nist.gov/vuln/detail/CVE-2024-12393
https://www.drupal.org/sa-core-2024-003
GHSA-8mvq-8h2v-j9vf https://github.com/advisories/GHSA-8mvq-8h2v-j9vf
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/drupal/core
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-12393
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.drupal.org/sa-core-2024-003
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.13396
EPSS Score 0.00045
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:09:41.253227+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-8mvq-8h2v-j9vf/GHSA-8mvq-8h2v-j9vf.json 36.1.3