Description
Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0, < 8.1.10 | 8.1.10 | GHSA-vhg8-x858-7wq6 |
| Packagist | drupal/drupal | >= 8.0, < 8.1.10 | 8.1.10 | GHSA-vhg8-x858-7wq6 |
References
- https://www.drupal.org/SA-CORE-2016-004
- 93101 vdb-entry
- 1036886 vdb-entry