6.1

CVE-2018-9861: ckeditor enhanced_image Cross-site Scripting

CVSS: 6.1v3.0MediumModified
AliasesUBUNTU-CVE-2018-9861GHSA-g78h-pf65-46rvDRUPAL-CORE-2018-003
Published 19-04-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-9861 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in ckeditor enhanced_image. EPSS estimates a 1.72% chance of exploitation in the next 30 days, higher than 77% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.0 (NVD)
EPSS score
1.72%
0%100%
Low · -0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
USN-5340-1USN-5340-2

Timeline

  1. 19-04-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.72%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

-0.03 pp

From 1.75% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.72%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Drupal3 products
  • core≥ 8.5.0, < 8.5.2 | ≥ 8.0, < 8.4.7
  • drupal≥ 8.0, < 8.4.7 | ≥ 8.5, < 8.5.2
  • drupal≥ 8.0.0, < 8.4.7 | ≥ 8.5.0, < 8.5.2
Ckeditor1 product
Npm1 product
  • ckeditor-dev≥ 4.5.10, < 4.9.2
Ubuntu1 product
  • ckeditor< 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 | < 4.5.7+dfsg-2ubuntu0.18.04.1

4 vendors · 6 products

References

11 links
Show all 11 references