[ASA-202106-35] drupal: cross-site scripting
santiago at archlinux.org
Thu Jun 17 16:25:03 UTC 2021
Arch Linux Security Advisory ASA-202106-35
Date : 2021-06-15
CVE-ID : CVE-2021-33829
Package : drupal
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-2069
The package drupal before version 9.1.10-1 is vulnerable to cross-site
Upgrade to 9.1.10-1.
# pacman -Syu "drupal>=9.1.10-1"
The problem has been fixed upstream in version 9.1.10.
Drupal core uses the third-party CKEditor library. This library has an
error in parsing HTML that could lead to a cross-site scripting (XSS)
attack. CKEditor 4.16.1 and later, as bundled with Drupal 9.1.9,
include the fix.
cross-site scripting using crafted HTML code.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security