CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2018-9861
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ckeditor:enhanced_image
- drupal:drupal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g78h-pf65-46rv | Packagist | drupal/core | >=8.5.0 <8.5.2 | 8.5.2 |
| GHSA-g78h-pf65-46rv | npm | ckeditor-dev | >=4.5.10 <4.9.2 | 4.9.2 |
| GHSA-g78h-pf65-46rv | Packagist | drupal/core | >=8.0 <8.4.7 | 8.4.7 |
| GHSA-g78h-pf65-46rv | Packagist | drupal/drupal | >=8.0 <8.4.7 | 8.4.7 |
| GHSA-g78h-pf65-46rv | Packagist | drupal/drupal | >=8.5 <8.5.2 | 8.5.2 |