[IT-SecNots] [Security-news] Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-core-2020-010

Project: Drupal core [1]
Date: 2020-September-16
Security risk: *Moderately critical* 13∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross-site scripting

CVE IDs: CVE-2020-13669
Description: 
Drupal core's built-in CKEditor image caption functionality is vulnerable to
XSS.

Solution: 
Install the latest version:

  * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10 [3].
  * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6 [4].
  * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.6 [5].

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive
security coverage. Sites on 8.7.x or earlier should update to 8.8.10.

Reported By: 
  * Dor Tumarkin  [6]
  * Krzysztof Krzton  [7]

Fixed By: 
  * Samuel Mortenson  [8] of the Drupal Security Team
  * Wim Leers  [9]
  * Henrik Danielsson  [10]
  * Dor Tumarkin  [11]
  * Jess   [12] of the Drupal Security Team
  * Krzysztof Krzton  [13]
  * Lee Rowlands  [14] of the Drupal Security Team


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/drupal/releases/8.8.10
[4] https://www.drupal.org/project/drupal/releases/8.9.6
[5] https://www.drupal.org/project/drupal/releases/9.0.6
[6] https://www.drupal.org/user/3648639
[7] https://www.drupal.org/user/3618903
[8] https://www.drupal.org/user/2582268
[9] https://www.drupal.org/user/99777
[10] https://www.drupal.org/user/244227
[11] https://www.drupal.org/user/3648639
[12] https://www.drupal.org/user/65776
[13] https://www.drupal.org/user/3618903
[14] https://www.drupal.org/user/395439

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news