Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

MEDIO 6.1CVE-2018-9861 · DRUPAL-CORE-2018-003 · GHSA-g78h-pf65-46rv · Published 19/04/2018 · updated 17/06/2026

In breve

CVE-2018-9861 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda drupal/core, drupal/drupal, enhanced image (ckeditor).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.5% delle vulnerabilità.
Correzione: aggiornare a 8.4.7, 8.5.2, 4.9.2 o successiva.

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 8.0, < 8.4.7≥ 8.0.0, < 8.4.7≥ 8.5.0, < 8.5.2`	`8.4.78.5.2`
drupal/drupal Packagist	`≥ 8.0, < 8.4.7≥ 8.5, < 8.5.2`	`8.4.78.5.2`
enhanced image ckeditor	`≥ 4.5.10, < 4.9.2`	`4.9.2`
drupal drupal	`≥ 8.0.0, < 8.4.7≥ 8.5.0, < 8.5.2`	`8.4.78.5.2`
ckeditor-dev npm	`≥ 4.5.10, < 4.9.2`	`4.9.2`

Description

The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a crafted IMG element.

NVD description

Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.