Drupal Cross-Site Scripting (XSS) in CKEditor Third-party Library
Summary
GHSA-qf65-hph9-453r: Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library. Affects drupal/drupal across 3 version ranges.
>= 8.0.0, < 8.9.16
>= 9.0.0, < 9.1.12
>= 9.2.0, < 9.2.4
Fixed in 8.9.16, 9.1.12 or 9.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. It utilizes the CKEditor library for providing a rich text editor functionality. CKEditor is a widely used third-party library for WYSIWYG editing. However, a security vulnerability has been discovered in CKEditor that affects Drupal installations.
Vulnerability Detail
The vulnerability arises when Drupal is configured to use the CKEditor library for WYSIWYG editing. It allows an attacker, even without direct access to CKEditor, to exploit one or more Cross-Site Scripting (XSS) vulnerabilities. This can be done by creating or editing content, potentially targeting users with access to the WYSIWYG CKEditor, including privileged site administrators. The impact of XSS vulnerabilities can range from unauthorized data access to arbitrary code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.9.168.9.16composer require drupal/drupal:8.9.16 -
>= 9.0.0, < 9.1.129.1.12composer require drupal/drupal:9.1.12 -
>= 9.2.0, < 9.2.49.2.4composer require drupal/drupal:9.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating Drupal and the CKEditor library is the recommended solution.
Conclusion
The Drupal Cross-Site Scripting (XSS) vulnerability in the CKEditor third-party library poses a moderate risk to Drupal installations. To mitigate this vulnerability, it is crucial to update Drupal to the latest version and ensure the CKEditor library is up to date. Regularly monitoring for security updates and promptly applying them is essential for maintaining the security of Drupal-based websites and applications. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and applications. It provides a flexible framework for managing and organizing content.
CKEditor is a popular WYSIWYG editor library used in various web applications, including Drupal. It allows users to create and edit content with rich text formatting capabilities.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized data access, session hijacking, or arbitrary code execution.
An attacker can exploit this vulnerability by creating or editing content that contains malicious scripts. When users with access to the CKEditor view or edit the content, the scripts can be executed in their browsers, potentially compromising their accounts or exposing sensitive information.
The impact of this vulnerability can vary depending on the attacker's intentions. It can lead to unauthorized data access, session hijacking, defacement of websites, or even remote code execution on the affected Drupal installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
