3.5 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
8.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
0.004 Low
EPSS
Percentile
75.1%
The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal, along with a hotfix for that update. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor’s security advisories: CVE-2021-41165: HTML comments vulnerability allowing to execute JavaScript code CVE-2021-41164: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML This advisory is not covered by Drupal Steward.
ckeditor.com/cke4/release/CKEditor-4.17.0
ckeditor.com/cke4/release/CKEditor-4.17.1
github.com/ckeditor/ckeditor4
github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2
github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj
www.drupal.org/project/drupal/releases/8.9.20
www.drupal.org/project/drupal/releases/9.1.14
www.drupal.org/project/drupal/releases/9.2.9
www.drupal.org/psa-2021-06-29
www.drupal.org/user/1078742
www.drupal.org/user/240860
www.drupal.org/user/36762
www.drupal.org/user/3683355
www.drupal.org/user/65776
www.drupal.org/user/99777
3.5 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
8.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
0.004 Low
EPSS
Percentile
75.1%