Drupal core allows XSS via CKEditor editor

Summary

If your Drupal site uses the CKEditor text editor, an attacker who can add or edit content could inject malicious code that runs in the browsers of other users, including administrators. This can lead to unauthorized actions or data theft. Update Drupal to the latest version, which upgrades CKEditor to a safe release, or disable the editor until you can apply the update.

What to do

Update drupal drupal/core to version 8.8.4.

Affected software

Ecosystem	Vendor	Product	Affected versions
Packagist	drupal	drupal/core	>= 8.8.0, < 8.8.4 Fix: upgrade to 8.8.4

Original advisory text

The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security improvement](https://ckeditor.com/blog/CKEditor-4.14-with-Paste-fro...

The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security improvement](https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-released/#security-issues-fixed) that is needed to protect some Drupal configurations.

Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site's users. An attacker that can create or edit content may be able to exploit this Cross Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, and this may include site admins with privileged access.

The latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities.

References

https://www.drupal.org/sa-core-2020-001 URL