SA-CORE-2024-003: Critical severity Drupal Drupal vulnerability
Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2024-003?
The severity of SA-CORE-2024-003 is considered critical due to the potential for JavaScript injection leading to cross-site scripting attacks.
How do I fix SA-CORE-2024-003?
To fix SA-CORE-2024-003, update your Drupal installation to versions 10.2.11, 10.3.9, or 11.0.8 or later.
What versions of Drupal are affected by SA-CORE-2024-003?
Drupal versions up to and including 10.2.10, 10.3.8, and 11.0.7 are affected by SA-CORE-2024-003.
What are the risks involved with leaving SA-CORE-2024-003 unpatched?
Leaving SA-CORE-2024-003 unpatched increases the risk of cross-site scripting vulnerabilities that could lead to data breaches or site takeovers.
Is there a workaround for SA-CORE-2024-003 if an immediate update is not possible?
Currently, there are no recommended workarounds for SA-CORE-2024-003 other than applying the security updates.