CVE-2018-9861 — Cross-site Scripting in Enhanced Image

CWE-79 — Cross-site Scripting14 documents7 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 41.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Ckeditor Enhanced ImageDrupalDrupal Core+1 more
Timeline
PublishedApr 19
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶NVDckeditor/enhanced_image4.5.10 — 4.9.2
▶Packagistdrupal/core8.0.0 — 8.4.7+2
▶NVDdrupal/drupal8.0.0 — 8.4.7+1
▶Packagistdrupal/drupal8.0 — 8.4.7+1
▶Ubuntuckeditor/ckeditor< 4.5.7+dfsg-2ubuntu0.18.04.1+2

🔴Vulnerability Details

7
GHSA
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)↗2022-05-14
▶
OSV
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)↗2022-05-14
▶
OSV
ckeditor vulnerabilities↗2022-03-23
▶
OSV
ckeditor vulnerabilities↗2022-03-22
▶
OSV
CVE-2018-9861: Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4↗2018-04-19
▶

📋Vendor Advisories

3
Ubuntu
CKEditor vulnerabilities↗2022-03-23
▶
Ubuntu
CKEditor vulnerabilities↗2022-03-22
▶
Drupal
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2018-003↗2018-04-18
▶

💬Community

3
Bugzilla
CVE-2018-9861 ckeditor: Cross-site scripting (XSS) vulnerability when using image2 plugin↗2018-04-20
▶
Bugzilla
CVE-2018-9861 ckeditor: Cross-site scripting (XSS) vulnerability when using image2 plugin [fedora-all]↗2018-04-20
▶
Bugzilla
CVE-2018-9861 drupal8: ckeditor: Cross-site scripting (XSS) vulnerability when using image2 plugin [fedora-all]↗2018-04-20
▶