CVE-2020-9281 CKEditor 4.0 vulnerability in the HTML Data Processor

What is CVE-2020-9281?

CVE-2020-9281 is a medium-severity cross-site scripting vulnerability in Drupal Drupal, published on 7 Mar 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Weakness: CWE-79

Which versions are affected by CVE-2020-9281?

3 open source packages ship an affected version, including drupal and ckeditor4. It affects 11 products.

Products include Ckeditor Ckeditor, Drupal Drupal, Fedoraproject Fedora, Oracle Agile Product Lifecycle Management, Oracle Application Express, Oracle Banking Enterprise Default Management and 5 more.

How do I fix CVE-2020-9281?

Upgrade drupal to a fixed version for your release line: 8.7.12 or 8.8.4.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-9281 being exploited?

There is no known exploitation of CVE-2020-9281 in the wild and no public exploit code.

Other vulnerabilities in Drupal Drupal

• CVE-2023-31541 File upload in n/a Critical 9.8
• CVE-2021-41164 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML High 8.2
• CVE-2021-41165 HTML comments vulnerability allowing to execute JavaScript code High 8.2
• CVE-2021-32808 Cross-site scripting in ckeditor via abuse of undo functionality High 7.6
• CVE-2011-4972 Missing authorization in CKEditor Drupal module High 7.5

All Drupal Drupal vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-drupal-2020-9281, GHSA-vcjf-mgcg-jxjq, UBUNTU-CVE-2020-9281.