CVSS base score
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.
Explanation of Vulnerability in Simple Terms
Drupal core versions 11.3.0 through 11.3.6 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of other users viewing affected pages. The vulnerability exists in core functionality and requires specific conditions to exploit. Update to Drupal 11.3.7 or later to resolve this issue.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
Site visitors' browsers could execute attacker-controlled JavaScript, potentially stealing session tokens or modifying page content.
Conditions required to exploit
Access to input that is processed and displayed without proper sanitization; may require user interaction.
Key dates
External resources
Related vulnerabilities
