Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005

{
  "id": "71317470d2dd9d05018910c61cecca959138e90186003fa4c63dee99e178215f",
  "url": "https://www.drupal.org/sa-core-2022-005",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005",
    "summary": "Drupal core updates CKEditor libraries to address vulnerabilities that may permit cross-site scripting or denial of service when CKEditor use is enabled. Update Drupal 9.3 or 9.2 to the specified fixed release.",
    "evidence": "The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Project: Drupal core"
        },
        "prerequisites": [
          {
            "value": "configured to allow use of the CKEditor library for WYSIWYG editing",
            "evidence": "Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing."
          }
        ],
        "fixed_versions": [
          {
            "value": "Drupal 9.3.8",
            "evidence": "If you are using Drupal 9.3, update to Drupal 9.3.8."
          },
          {
            "value": "Drupal 9.2.15",
            "evidence": "If you are using Drupal 9.2, update to Drupal 9.2.15."
          }
        ],
        "affected_versions": [
          {
            "value": ">= 8.0.0 <9.2.15 || >= 9.3.0 <9.3.8",
            "evidence": "Affected versions: >= 8.0.0 <9.2.15 || >= 9.3.0 <9.3.8"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2022-24728",
        "evidence": "CVE IDs: CVE-2022-24728 CVE-2022-24729"
      },
      {
        "value": "CVE-2022-24729",
        "evidence": "CVE IDs: CVE-2022-24728 CVE-2022-24729"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-drupal-security",
  "document_id": 23501,
  "published_at": "2022-03-16T16:10:34+00:00"
}