Drupal 8 core - Moderately critical - Third-party library - SA-CORE-2020-001

Project: Drupal core
Versions: 8.8.x-dev, 8.7.x-dev
Date: 2020-March-18
Security risk: Moderately critical 13∕25
Vulnerability: Third-party library

Description

The Drupal project uses the third-party library CKEditor, which has released a security improvement that is needed to protect some Drupal configurations.

Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site’s users. When multiple people can edit content, the vulnerability can be used to execute XSS attacks against other people, including site admins with more access.

The latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities.

Solution

Install the latest version:

If you are using Drupal 8.8.x, upgrade to Drupal 8.8.4.
If you are using Drupal 8.7.x, upgrade to Drupal 8.7.12.
Versions of Drupal 8 prior to 8.7.x have reached end-of-life and do not receive security coverage.

The CKEditor module can also be disabled to mitigate the vulnerability until the site is updated.

Note for Drupal 7 users

Drupal 7 core is not affected by this release; however, users who have installed the third-party CKEditor library (for example, with a contributed module) should ensure that the downloaded library is updated to CKEditor 4.14 or higher, or that CDN URLs point to a version of CKEditor 4.14 or higher. Disabling all WYSIWYG modules can mitigate the vulnerability until the site is updated.