GitHub Advisoryadvisory · Packagist

GHSA-qf65-hph9-453r Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗
Ecosystem
Packagist
Packages
drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-15

Affected packages

• Packagist drupal/drupal: >= 8.0.0, < 8.9.16 → fixed in 8.9.16 • Packagist drupal/drupal: >= 9.0.0, < 9.1.12 → fixed in 9.1.12 • Packagist drupal/drupal: >= 9.2.0, < 9.2.4 → fixed in 9.2.4

Description

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References