The team has released security updates for versions 8.8.x and 8.7.x that address two XSS vulnerabilities affecting CKEditor, the successor to FCKeditor. It is a popular, excellent, and open source WYSIWYG editor.
Drupal uses CKEditor, which was updated to version 4.14, which addresses these XSS vulnerabilities.
“The Drupal project uses the CKEditor library, which has released some security updates necessary to protect certain Drupal configurations,” says a Drupal announcement.
“vulnerabilities are possible if Drupal uses WYSIWYG for users . A hacker who can create or edit content could exploit this XSS (Cross Site Scripting) vulnerability and target users who have access to the WYSIWYG CKEditor, such as administrators with privileged privileges. Both of these issues were rated as moderate in severity and received a risk score of 13/25.
The latest versions of Drupal, versions 8.8.4 or 8.7.12, include version 4.14 of CKEditor which addresses both issues.
Drupal 8 versions prior to 8.7.x will no longer receive updates . Drupal 7 is also not affected by the above issue, but it is recommended to use CKEditor version 4.14 or later. However, the risk of exploitation could be reduced by disabling CKEditor.
For example, one of the XSS flaws affects the HTML editor.So it could be exploited by putting malicious HTML code in the editor, whether it is in WYSIWYG mode or in source mode.
The other issue affects a third-party plugin called WebSpellChecker Dialog that is included in the defaults of CKEditor 4. It could be exploited by an attacker, causing the victim to switch CKEditor to source mode. The attacker could then add malicious code, and view the contents of the page after the victim returns to WYSIWYG.
