Backdrop core - Moderately critical - Cross Site Scripting - SA-CORE-2018-003

Date:

Wednesday, Apr 18th, 2018

Advisory ID:

BACKDROP-SA-CORE-2018-003

Security risk:

Moderately Critical

Vulnerability:

Cross Site Scripting

CVE ID:

CVE-2018-9861

Versions affected:

Backdrop Core 1.x.x versions prior to 1.9.4

Description:

CKEditor, a third-party JavaScript library included in Backdrop core, has fixed a cross-site scripting (XSS) vulnerability. The vulnerability stemmed from the fact that it was possible to execute XSS inside CKEditor when using the image2 plugin (which Backdrop core also uses).

Solution:

Upgrade your site to the most recent version of Backdrop core. Download available on the Backdrop CMS 1.9.4 release page. See the update instructions, if needed.

Reported By:

Kyaw Min Thein

Fixed By:

Marek Lewandowski of the CKEditor team
Wiktor Walc of the CKEditor team
Nate Lampton of the Backdrop CMS Security Team

Coordinated By:

Geoff St. Pierre of the Backdrop CMS Security Team
Jen Lampton of the Backdrop CMS Security Team

Security email list

Backdrop maintains a security mailing list. Whenever a security release comes out, an email will be sent to everyone subscribed to that list, announcing the new release. Please follow the steps below to join the Security email list.

Log in to backdropcms.org
Edit your profile
Switch to the "Subscriptions" tab
Check the box labeled "Security updates"
Save the form

Report security issues responsibly

If you have found a security issue, send an email to security@backdropcms.org. Do not file an issue on GitHub, or otherwise announce the issue publicly.

See more about Backdrop security.

Security Advisories

The list below includes the latest advisories for both Backdrop core and any project in the contributed repository. See the entire list of all advisories.