CVE-2018-9861: XSS

Q: What is CVE-2018-9861?

CVE-2018-9861 is a vulnerability in the Enhanced Image plugin for CKEditor in versions 4.5.10 through 4.9.1, fixed in 4.9.2.

Q: How severe is CVE-2018-9861?

CVE-2018-9861 has a severity value of 6.1 (moderately critical).

Q: What is the affected software for CVE-2018-9861?

The affected software for CVE-2018-9861 includes CKEditor versions 4.5.10 through 4.9.1, Drupal 8 before 8.4.7, and Drupal 8.5.x before 8.5.2.

Q: How do I fix CVE-2018-9861?

To fix CVE-2018-9861, update CKEditor to version 4.9.2 and Drupal to versions 8.4.7 or 8.5.2.

Q: What is the Common Weakness Enumeration (CWE) for CVE-2018-9861?

The Common Weakness Enumeration (CWE) for CVE-2018-9861 is CWE-79 (Cross-Site Scripting).

Published Apr 18, 2018

Updated

Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.

Other sources

Moderately critical - Cross Site Scripting

The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a crafted IMG element.

Affected Software

10 affected componentsFixes available

composer/drupal/core>=8.0, <8.1.0, >=8.1.0, <8.2.0, >=8.2.0, <8.3.0, >=8.3.0, <8.4.0, >=8.4, <8.4.7, >=8.5, <8.5.2

composer/drupal/drupal>=8.0, <8.1.0, >=8.1.0, <8.2.0, >=8.2.0, <8.3.0, >=8.3.0, <8.4.0, >=8.4, <8.4.7, >=8.5, <8.5.2

composer/drupal/drupal>=8.5<8.5.2

8.5.2

composer/drupal/drupal>=8.0<8.4.7

8.4.7

npm/ckeditor-dev>=4.5.10<4.9.2

4.9.2

composer/drupal/core>=8.5.0<8.5.2

8.5.2

composer/drupal/core>=8.0<8.4.7

8.4.7

CKEditor Enhanced Image Ckeditor>=4.5.10<4.9.2

Drupal Drupal>=8.0.0<8.4.7

Drupal Drupal>=8.5.0<8.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/drupal to a version that resolves this vulnerability.
Fixed in 8.5.2
Upgrade
Upgrade composer/drupal/drupal to a version that resolves this vulnerability.
Fixed in 8.4.7
Upgrade
Upgrade npm/ckeditor-dev to a version that resolves this vulnerability.
Fixed in 4.9.2
Upgrade
Upgrade composer/drupal/core to a version that resolves this vulnerability.
Fixed in 8.5.2
Upgrade
Upgrade composer/drupal/core to a version that resolves this vulnerability.
Fixed in 8.4.7
Upgrade
Upgrade CKEditor Enhanced Image (image2) plugin to a version that resolves this vulnerability.
Fixed in 4.9.2
Upgrade
Upgrade Drupal 8 (where CKEditor image2 plugin is used) to a version that resolves this vulnerability.
Fixed in 8.4.7
Upgrade
Upgrade Drupal 8 (where CKEditor image2 plugin is used) to a version that resolves this vulnerability.
Fixed in 8.5.2

Event History

Apr 18, 2018

Advisory Published

05:53 PM

Apr 19, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2018-9861?

CVE-2018-9861 is a vulnerability in the Enhanced Image plugin for CKEditor in versions 4.5.10 through 4.9.1, fixed in 4.9.2.

How severe is CVE-2018-9861?