Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Drupal 8.x CKEditor Vulnerability (SA-CORE-2020-001) (Windows)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
Drupal is prone to a cross-site scripting vulnerabilitu in third-party library.
Insight
Insight
The Drupal project uses the third-party library CKEditor, which has released a security improvement that is needed to protect some Drupal configurations. Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site's users. When multiple people can edit content, the vulnerability can be used to execute XSS attacks against other people, including site admins with more access.
Affected Software
Affected Software
Drupal 8.7.x and 8.8.x.
Detection Method
Detection Method
Checks if a vulnerable version is present on the target host.
Solution
Solution
Update to version 8.7.12, 8.8.4 or later.