1. Startseite

CIVI-SA-2020-12: XSS in CKEditor Configuration

Veröffentlicht
2020-08-19 09:00
Written by
dev-team

CiviCRM did not provide sufficient protection on the CKEditor configuration form, which could allow user to store and execute Javascript.

Note: This form had another vulnerability in the same version. The risk from two overlapping vulnerabilities may be greater than the risk of each individually.

Security Risk
Critical
Vulnerability
Cross Site Scripting
Affected Versions

CiviCRM version 5.28.0 and earlier

Fixed Versions

CiviCRM version 5.28.1 and 5.27.5 ESR

Publication Date
Solutions

Upgrade to the latest CiviCRM Version and also ensure that now variable has been set for the customConfig configuration within the ckeditor configuration files in the uploads folder

Credits

Dennis Brinkrolf of RIPS Technologies and Cure53 and Mozilla Open Source Support (MOSS) for reporting the issue
Coleman Watts of CiviCRM Core Team for fixing the issue

References

MOSS CIV-01-017
securirty/core#74