PT-2024-40464 · Drupal+1 · Drupal+1

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions (affected versions not specified)

Description The issue is related to the use of the third-party library CKEditor in Drupal, which has a security improvement that protects against Cross Site Scripting (XSS) vulnerabilities. If Drupal is configured to use the WYSIWYG CKEditor, an attacker who can create or edit content may exploit this vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

Recommendations Update CKEditor to version 4.14 to mitigate the vulnerabilities. As a temporary workaround, consider restricting access to the WYSIWYG CKEditor to minimize the risk of exploitation.

Fix

Related Identifiers

GHSA-V273-J5HQ-26XP

Affected Products

Ckeditor

Drupal

References · 4

• https://osv.dev/vulnerability/GHSA-v273-j5hq-26xp · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-03-18.yaml · Note
• https://github.com/drupal/core · Note
• https://drupal.org/sa-core-2020-001 · Note