CVE-2020-13669

Vulnerability

Cross-site Scripting (XSS) vulnerability in the CKEditor component of Drupal Core allows an attacker to inject arbitrary JavaScript. Affected versions: Drupal Core 8.8.x prior to 8.8.10, 8.9.x prior to 8.9.6, and 9.0.x prior to 9.0.6. [2]

Exploitation

An attacker must be able to submit content that is rendered by CKEditor. This can be achieved through any input field that uses the editor. The attacker crafts a payload containing malicious script, which is stored or reflected and executed in the context of the victim's browser.

Impact

Successful exploitation leads to Cross-site Scripting (XSS), allowing the attacker to execute arbitrary JavaScript in the victim's session. This can result in data theft, session hijacking, or defacement.

Mitigation

Upgrade to Drupal Core version 8.8.10, 8.9.6, or 9.0.6 or later, which contain the fix. No workaround is mentioned; applying the update is recommended.