View online: https://www.drupal.org/sa-core-2020-010
Project: Drupal core [1] Date: 2020-September-16 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting
CVE IDs: CVE-2020-13669 Description: Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS.
Solution: Install the latest version:
* If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10 [3]. * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6 [4]. * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.6 [5].
Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.10.
Reported By: * Dor Tumarkin [6] * Krzysztof Krzton [7]
Fixed By: * Samuel Mortenson [8] of the Drupal Security Team * Wim Leers [9] * Henrik Danielsson [10] * Dor Tumarkin [11] * Jess [12] of the Drupal Security Team * Krzysztof Krzton [13] * Lee Rowlands [14] of the Drupal Security Team
[1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.8.10 [4] https://www.drupal.org/project/drupal/releases/8.9.6 [5] https://www.drupal.org/project/drupal/releases/9.0.6 [6] https://www.drupal.org/user/3648639 [7] https://www.drupal.org/user/3618903 [8] https://www.drupal.org/user/2582268 [9] https://www.drupal.org/user/99777 [10] https://www.drupal.org/user/244227 [11] https://www.drupal.org/user/3648639 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/3618903 [14] https://www.drupal.org/user/395439