Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

Also known as DRUPAL-CORE-2018-003, GHSA-g78h-pf65-46rv

Published 8 y ago 2018-04-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.7%

percentile 78%

Public exploits

none known

Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.

Exploit prediction (EPSS)

1.72% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`drupal/core`	>=8.5.0, <8.5.2 >=8.0, <8.4.7 >=8.0.0, <8.4.7	8.5.2 8.4.7
npm	`ckeditor-dev`	>=4.5.10, <4.9.2	4.9.2
packagist	`drupal/drupal`	>=8.0, <8.4.7 >=8.5, <8.5.2	8.4.7 8.5.2

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /ckeditor/ckeditor-dev/blob/master/CHANGES.md · x_refsource_CONFIRM, x_transferred
drupal.org /sa-core-2018-003 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/103924 · vdb-entry, x_refsource_BID, x_transferred
oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-9861 · advisory
github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-9861.yaml · web
github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-9861.yaml · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.