Vulnerability in Drupal Core using CKEditor
Summary
GHSA-337w-fxpq-5m34: Drupal core uses a vulnerable Third-party library CKEditor. Affects drupal/drupal across 2 version ranges.
>= 8.0.0, < 8.7.12
>= 8.8.0, < 8.8.4
Fixed in 8.7.12 or 8.8.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) that allows users to easily create and manage websites. It utilizes various third-party libraries to enhance its functionality, one of which is CKEditor. CKEditor is a popular WYSIWYG editor used for creating and editing content on Drupal sites. However, a security vulnerability has been discovered in CKEditor that affects certain configurations of Drupal.
Vulnerability Detail
The vulnerability in CKEditor used by Drupal core is a Cross-Site Scripting (XSS) vulnerability. This means that an attacker who can create or edit content on a Drupal site may be able to inject malicious scripts into the site's content. This can lead to various security risks, including the targeting of users with access to the WYSIWYG CKEditor, which may include site administrators with privileged access. The vulnerability has a CVSS score of 4.2, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.128.7.12composer require drupal/drupal:8.7.12 -
>= 8.8.0, < 8.8.48.8.4composer require drupal/drupal:8.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update Drupal to the latest version with the patched CKEditor library.
Conclusion
In conclusion, Drupal core using CKEditor is vulnerable to a Cross-Site Scripting (XSS) vulnerability. To mitigate this vulnerability, it is crucial to update Drupal to the latest version that includes the patched CKEditor library. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal is an open-source content management system (CMS) used for building and managing websites.
CKEditor is a popular WYSIWYG editor used for creating and editing content on Drupal sites.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The potential risks of this vulnerability include the targeting of users with access to the WYSIWYG CKEditor, which may include site administrators with privileged access.
The CVSS score of this vulnerability is 4.2, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
