[Security-news] Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010

[security-news at drupal.org]

View online: https://www.drupal.org/sa-core-2020-010

Project: Drupal core [1]
Date: 2020-September-16
Security risk: *Moderately critical* 13∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross-site scripting

CVE IDs: CVE-2020-13669
Description: 
Drupal core's built-in CKEditor image caption functionality is vulnerable to
XSS.

Solution: 
Install the latest version:

   * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.10 [3].
   * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.6 [4].
   * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.6 [5].

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive
security coverage. Sites on 8.7.x or earlier should update to 8.8.10.

Reported By: 
   * Dor Tumarkin  [6]
   * Krzysztof Krzton  [7]

Fixed By: 
   * Samuel Mortenson  [8] of the Drupal Security Team
   * Wim Leers  [9]
   * Henrik Danielsson  [10]
   * Dor Tumarkin  [11]
   * Jess   [12] of the Drupal Security Team
   * Krzysztof Krzton  [13]
   * Lee Rowlands  [14] of the Drupal Security Team


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/drupal/releases/8.8.10
[4] https://www.drupal.org/project/drupal/releases/8.9.6
[5] https://www.drupal.org/project/drupal/releases/9.0.6
[6] https://www.drupal.org/user/3648639
[7] https://www.drupal.org/user/3618903
[8] https://www.drupal.org/user/2582268
[9] https://www.drupal.org/user/99777
[10] https://www.drupal.org/user/244227
[11] https://www.drupal.org/user/3648639
[12] https://www.drupal.org/user/65776
[13] https://www.drupal.org/user/3618903
[14] https://www.drupal.org/user/395439