CVE-2022-24728: Drupal - CKEditor4 HTML Injection Vulnerability
Summary
CVE-2022-24728: Cross-site Scripting in CKEditor4. Affects drupal across 2 version ranges.
>= 8.0.0, < 9.2.15
>= 9.3.0, < 9.3.8
Fixed in 9.2.15 or 9.3.8, depending on the release line you run. How to fix ↓
Also tracked for
- ckeditor4 · npm
- ckeditor · Debian:11
- drupal/core · Packagist
The same CVE-2022-24728 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. CKEditor4 is an open-source HTML editor integrated into Drupal for providing a what-you-see-is-what-you-get (WYSIWYG) editing experience. It allows users to create and edit HTML content easily. However, a vulnerability has been discovered in the core HTML processing module of CKEditor4, affecting all plugins used by CKEditor4 versions prior to 4.18.0.
Vulnerability Detail
The vulnerability in CKEditor4 allows an attacker to inject malformed HTML code, bypassing content sanitization mechanisms. This can lead to the execution of arbitrary JavaScript code, posing a significant security risk. The issue has been addressed in CKEditor4 version 4.18.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 9.2.159.2.15 -
>= 9.3.0, < 9.3.89.3.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The CKEditor4 HTML Injection Vulnerability in Drupal poses a significant security risk as it allows for the execution of arbitrary JavaScript code. It is crucial to upgrade CKEditor4 to version 4.18.0 or later to mitigate this vulnerability. Keeping Drupal and its plugins up to date is also recommended. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
CKEditor4 is an open-source HTML editor used in Drupal for WYSIWYG editing.
The vulnerability allows an attacker to inject malicious HTML code, potentially leading to the execution of arbitrary JavaScript code.
All versions of CKEditor4 prior to 4.18.0 are affected by this vulnerability.
Yes, the vulnerability has been patched in CKEditor4 version 4.18.0.
There are currently no known workarounds for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
