====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN167
_____________________________________________________________________

DATE                : 20/04/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Drupal core versions prior to
                                     8.5.2, 8.4.7.

=====================================================================
https://www.drupal.org/sa-core-2018-003
_____________________________________________________________________

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2018-003

Project:        Drupal core

Date:           2018-April-18

Security risk:  Moderately critical 12/25

AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default

Vulnerability:  Cross Site Scripting

Description:

CKEditor, a third-party JavaScript library included in Drupal core, has
fixed a cross-site scripting (XSS) vulnerability. The vulnerability
stemmed from the fact that it was possible to execute XSS inside
CKEditor when using the image2 plugin (which Drupal 8 core also uses).

We would like to thank the CKEditor team for patching the vulnerability
and coordinating the fix and release process, and matching the Drupal
core security window.

Solution:

  o If you are using Drupal 8, update to Drupal 8.5.2 or Drupal 8.4.7.
  o The Drupal 7.x CKEditor contributed module is not affected if you
    are running CKEditor module 7.x-1.18 and using CKEditor from the
    CDN, since it currently uses a version of the CKEditor library that
    is not vulnerable.
  o If you installed CKEditor in Drupal 7 using another method (for
    example with the WYSIWYG module or the CKEditor module with CKEditor
    locally) and you're using a version of CKEditor from 4.5.11 up to
    4.9.1, update the third-party JavaScript library by downloading
    CKEditor 4.9.2 from CKEditor's site.


Reported By:

  o Kyaw Min Thein


Fixed By:

  o Marek Lewandowski of the CKEditor team
  o Wiktor Walc of the CKEditor team
  o Wim Leers
  o xjm Of the Drupal Security Team
  o Lee Rowlands of the Drupal Security Team
  o Daniel Wehner
  o Hai-Nam Nguyen
  o Matthew Grill


Contact and more information

The Drupal security team can be reached by email at security at
drupal.org or via the contact form.

Learn more about the Drupal Security team and their policies, writing
secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter @drupalsecurity

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================