-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit shows critical XSS fixes through: 1) Removal of filter_xss_admin in actions.inc logging (CWE-79), 2) Addition of filter_xss_admin in system_mail message processing, 3) Sanitization improvements in system_message_action for node/term properties, and 4) XSS filtering added in trigger module's admin display. These correspond directly to the vulnerability's attack vectors (action descriptions/messages, node/term input). The pattern shows missing output encoding in these functions prior to 6.18.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/drupal | composer | >= 6.0, < 6.18 | 6.18 |