tocsin

CVE-2018-9861

4 advisories.

Packagist/drupal/core CVE-2018-9861: unknown, EPSS 1.72%

CKEditor, a third-party JavaScript library included in Drupal core, has [fixed a cross-site scripting (XSS) vulnerability](https://ckeditor.com/blog/CKEditor-4.9.2-with-a-security-patch-released/). Th

Action: Upgrade drupal/core to 8.4.7 or later.

composer require drupal/core:8.4.7
composer require drupal/core:8.5.2

Affected

introducedfixedlast affected
8.0.08.4.7-
8.5.08.5.2-

Fixed versions

8.4.78.5.2

Sources

CVE-2018-9861 · published · modified · JSON

Packagist/drupal/core CVE-2018-9861: medium 6.1, EPSS 1.72%

Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

Action: Upgrade drupal/core to 8.4.7 or later.

composer require drupal/core:8.5.2
composer require drupal/core:8.4.7

Affected

introducedfixedlast affected
8.5.08.5.2-
8.08.4.7-

Fixed versions

8.5.28.4.7

Sources

CVE-2018-9861 · published · modified · JSON

npm/ckeditor-dev CVE-2018-9861: medium 6.1, EPSS 1.72%

Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

Action: Upgrade ckeditor-dev to 4.9.2 or later.

npm i ckeditor-dev@4.9.2

Affected

introducedfixedlast affected
4.5.104.9.2-

Fixed versions

4.9.2

Sources

CVE-2018-9861 · published · modified · JSON

Packagist/drupal/drupal CVE-2018-9861: medium 6.1, EPSS 1.72%

Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

Action: Upgrade drupal/drupal to 8.4.7 or later.

composer require drupal/drupal:8.4.7
composer require drupal/drupal:8.5.2

Affected

introducedfixedlast affected
8.08.4.7-
8.58.5.2-

Fixed versions

8.4.78.5.2

Sources

CVE-2018-9861 · published · modified · JSON