Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Proof/TD:All Vulnerability: Cross site scripting Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-3057 Description: Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS). Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given th…

Drupal Security Advisoriesで読む

2025/02/20 01:49、Drupal Security Advisoriesが「Drupal core - Critical - Cross site scripting - SA-CORE-2025-001」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「緊急」(critical) です。関連する技術: Drupal、PHP。CVE: CVE-2025-3057。