CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that on certain configurations may impact the Drupal module that bundles and integrates this code. The vulnerability is mitigated by the fact it requires: full-page editing mode is enabled or CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements) are enabled. An attacker must have a permission with access to the CKEditor instance. For more information, see CKEditor’s security advisory: CVE-2024-24815: Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection