Reflected cross-site scripting (XSS) In drupal/drupal
Description
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS) The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a crafted IMG element.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 8.4.7, 8.5.2 | ||
 npm | 4.9.2 | ||
packagist | 8.5.2, 8.4.7 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4. 5. 6.