GitHub Advisoryadvisory · Packagist, npm

GHSA-g78h-pf65-46rv Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

MEDIUM Published 2022-05-14 Modified 2023-10-19 Official page ↗
Aliases
CVE-2018-9861
Ecosystem
Packagist, npm
Packages
drupal/core, ckeditor-dev, drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-10-19

Affected packages

• Packagist drupal/core: >= 8.5.0, < 8.5.2 → fixed in 8.5.2 • npm ckeditor-dev: >= 4.5.10, < 4.9.2 → fixed in 4.9.2 • Packagist drupal/core: >= 8.0, < 8.4.7 → fixed in 8.4.7 • Packagist drupal/drupal: >= 8.0, < 8.4.7 → fixed in 8.4.7 • Packagist drupal/drupal: >= 8.5, < 8.5.2 → fixed in 8.5.2

Description

The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a crafted IMG element.

Related

Alias · CVE (1)

  • CVE-2018-9861 Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References