The Drupal project uses the third-party library CKEditor, which has released a security improvement that is needed to protect some Drupal configurations.
Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site's users. An attacker that can create or edit content may be able to exploit this Cross Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, and this may include site admins with privileged access.
The latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities.
Install the latest version:
- If you are using Drupal 8.8.x, upgrade to Drupal 8.8.4.
- If you are using Drupal 8.7.x, upgrade to Drupal 8.7.12.
Versions of Drupal 8 prior to 8.7.x have reached end-of-life and do not receive security coverage.
The CKEditor module can also be disabled to mitigate the vulnerability until the site is updated.
Note for Drupal 7 users
Drupal 7 core is not affected by this release; however, users who have installed the third-party CKEditor library (for example, with a contributed module) should ensure that the downloaded library is updated to CKEditor 4.14 or higher, or that CDN URLs point to a version of CKEditor 4.14 or higher. Disabling all WYSIWYG modules can mitigate the vulnerability until the site is updated.