Drupal 9 Core with Moderately Critical Vulnerability in Third-Party Libraries

Staff Reporter

The Drupal Security team announced on March 16, 2022, a moderately critical vulnerability in Drupal 9 Core third-party libraries SA-CORE-2022-005. The vulnerability is classified as moderately critical based on the 13∕25 (AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default) status.

CKEditor released two security updates namely CVE-2022-24728 & CVE-2022-24729. Drupal 9 Core uses the CKEditor library for WYSIWYG editing and therefore is impacted. CKEditor's security advisories are:

According to the security advisory, vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

Jacek Bogdanski of CKSource reported the update which was fixed in Drupal 9 Core by Jess and Lee Rowlands of the Drupal Security Team and Wim Leers.

Solution:
The recommendation is to install the latest version. For Drupal 9.3 users, update to Drupal 9.3.8 and Drupal 9.2 users are advised to update to Drupal 9.2.15.

This advisory is not covered by Drupal Steward.

Note: While Drupal 7 core is not affected, Drupal 7, 8, and 9 site owners are being asked to review their site following the protocol for managing external libraries and plugins previously suggested by the Drupal Security Team. Contributed projects may use additional CKEditor plugins not packaged in Drupal core.

Users of the Webform module should ensure Webform's version of CKEditor 4 is also up-to-date after updating Drupal core and libraries for any affected contributed modules.

Source: https://www.drupal.org/sa-core-2022-005

Drupal 9

Security Updates

CKEditor

Note: The vision of this web portal is to help promote news and stories around the Drupal community and promote and celebrate the people and organizations in the community. We strive to create and distribute our content based on these content policy. If you see any omission/variation on this please reach out to us at #thedroptimes channel on Drupal Slack and we will try to address the issue as best we can.