CVE-2026-107308 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Country

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-211

History

Fri, 30 Oct 2026 23:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal country
Vendors & Products		Drupal Drupal country

Fri, 30 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 30 Oct 2026 03:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.
Title		Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2026-211

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-30T03:10:03.911Z

Updated: 2026-10-30T20:34:57.018Z

Reserved: 2026-10-07T16:30:25.712Z

Link: CVE-2026-107308

Vulnrichment

Updated: 2026-10-30T20:34:49.273Z

NVD

Status : Awaiting Analysis

Published: 2026-10-30T04:17:58.590

Modified: 2026-10-30T21:16:50.017

Link: CVE-2026-107308

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107308", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-10-07T16:30:25.712Z", "datePublished": "2026-10-30T03:10:03.911Z", "dateUpdated": "2026-10-30T20:34:57.018Z"}, "containers": {"cna": {"title": "Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211", "datePublic": "2026-10-07T16:36:17.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-211"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/country", "product": "Country", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/country", "versions": [{"lessThan": "2.1.3", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2.2.1", "status": "affected", "version": "2.2.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1."}], "credits": [{"lang": "en", "type": "finder", "value": "Conrad Lara (cmlara)"}, {"lang": "en", "type": "remediation developer", "value": "Boris Doesborg (batigolix)"}, {"lang": "en", "type": "remediation developer", "value": "Conrad Lara (cmlara)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:10:03.911Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T20:34:53.334589Z", "id": "CVE-2026-107308", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:34:57.018Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-107308", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T20:34:53.334589Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:34:49.273Z"}}], "cna": {"title": "Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211", "credits": [{"lang": "en", "type": "finder", "value": "Conrad Lara (cmlara)"}, {"lang": "en", "type": "remediation developer", "value": "Boris Doesborg (batigolix)"}, {"lang": "en", "type": "remediation developer", "value": "Conrad Lara (cmlara)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/country", "vendor": "Drupal", "product": "Country", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.1.3", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/country"}], "datePublic": "2026-10-07T16:36:17.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-211"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:10:03.911Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107308", "state": "PUBLISHED", "dateUpdated": "2026-10-30T20:34:57.018Z", "dateReserved": "2026-10-07T16:30:25.712Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-30T03:10:03.911Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}