Drupal : ckeditor.com Persistent Cross Site Scripting Vulnerability

 

Summary:

The Drupal 3rd Party editor module, CKEditor is vulnerable to a Persistent EventHandler XSS According to the advisory -”The editor is prone to Persistent Cross-Site Scripting within the actual editor, as it is possible for an attacker could maliciously inject eventhandlers serving java-script code in preview / editing in html mode.” This could lead to the administrator triggering the javascript  (e.g. “onload=’alert(0);’”). Note this XSS will execute only during preview or editing in HTML Mode.

What do I do to fix this?

There is not a current solution. According to the developers see: https://dev.ckeditor.com/ticket/8630 they do not consider it a flaw. Recommendation is  to check with the developers to see if you are at risk, or change editors. Reported by : MaXe (@InterN0T) – Hatforce.com