Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

TRUNG BÌNH 6.1CVE-2018-9861 · DRUPAL-CORE-2018-003 · GHSA-g78h-pf65-46rv · Công bố 19/04/2018 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2018-9861 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng drupal/core, drupal/drupal, enhanced image (ckeditor).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.7%, cao hơn 77.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 8.4.7, 8.5.2, 4.9.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
drupal/core Packagist	`≥ 8.0, < 8.4.7≥ 8.0.0, < 8.4.7≥ 8.5.0, < 8.5.2`	`8.4.78.5.2`
drupal/drupal Packagist	`≥ 8.0, < 8.4.7≥ 8.5, < 8.5.2`	`8.4.78.5.2`
enhanced image ckeditor	`≥ 4.5.10, < 4.9.2`	`4.9.2`
drupal drupal	`≥ 8.0.0, < 8.4.7≥ 8.5.0, < 8.5.2`	`8.4.78.5.2`
ckeditor-dev npm	`≥ 4.5.10, < 4.9.2`	`4.9.2`

Mô tả

The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a crafted IMG element.

Mô tả của NVD

Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.