Packagist/drupal/drupal CVE-2018-9861: medium 6.1, EPSS 1.72%

Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

Action: Upgrade drupal/drupal to 8.4.7 or later.

composer require drupal/drupal:8.4.7

composer require drupal/drupal:8.5.2

Affected

Fixed versions

Sources

• osv: GHSA-g78h-pf65-46rv#Packagist/drupal/drupal
• https://nvd.nist.gov/vuln/detail/CVE-2018-9861
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-9861.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-9861.yaml
• https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md
• https://www.drupal.org/sa-core-2018-003
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• http://www.securityfocus.com/bid/103924

CVE-2018-9861 · published 2022-05-14T00:56:02Z · modified 2025-12-10T23:41:15.971028Z · JSON