Skip to content
Fencer Intel
no cvss —

DRUPAL-CORE-2021-011 json

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing.

published 4y ago modified last mo.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has released [a security update that impacts Drupal](https://ckeditor.com/cke4/release/CKEditor-4.17.0), along with a [hotfix for that update](https://ckeditor.com/cke4/release/CKEditor-4.17.1).

Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisories:

* [CVE-2021-41165: HTML comments vulnerability allowing to execute JavaScript code](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2) * [CVE-2021-41164: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj)

This advisory is not covered by [Drupal Steward](/steward).

Patch / fix

  • packagist drupal/core 8.9.20, 9.1.14, 9.2.9

Is DRUPAL-CORE-2021-011 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist drupal/core
>=8.0.0, <8.9.20
>=9.1.0, <9.1.14
>=9.2.0, <9.2.9
8.9.20
9.1.14
9.2.9

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.