Medium severity · published Apr 19, 2018
CVE-2018-9861
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before…
6.1
CVSS
1.7%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
8.0.0 before 8.4.7; 8.5.0 before 8.5.2 · source: NVD
EI
Enhanced Image · Ckeditor
4.5.10 before 4.9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-9861
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-9861
www.securityfocus.com
http://www.securityfocus.com/bid/103924
Release Notes
https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md
Third Party Advisory
https://www.drupal.org/sa-core-2018-003
www.oracle.com
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution