CiviCRM did not provide sufficient protection on the CKEditor configuration form, which could allow user to store and execute Javascript.
Note: This form had another vulnerability in the same version. The risk from two overlapping vulnerabilities may be greater than the risk of each individually.
CiviCRM version 5.28.0 and earlier
CiviCRM version 5.28.1 and 5.27.5 ESR
Upgrade to the latest CiviCRM Version and also ensure that now variable has been set for the customConfig configuration within the ckeditor configuration files in the uploads folder
Dennis Brinkrolf of RIPS Technologies and Cure53 and Mozilla Open Source Support (MOSS) for reporting the issue
Coleman Watts of CiviCRM Core Team for fixing the issue
MOSS CIV-01-017
securirty/core#74
