Test ID:	1.3.6.1.4.1.25623.1.0.112891
Category:	Web application abuses
Title:	Drupal < 8.9.16, 9.0.x < 9.0.14, 9.1.x < 9.1.9 XSS Vulnerability (SA-CORE-2021-003) - Windows
Summary:	Drupal is prone to a cross-site scripting (XSS) vulnerability.
Description:	Summary: Drupal is prone to a cross-site scripting (XSS) vulnerability. Vulnerability Insight: Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to an XSS attack. This issue is mitigated by the fact that it only affects sites with CKEditor enabled. Affected Software/OS: Drupal before 8.9.16, 9.0.x before 9.0.14, and 9.1.x before 9.1.9. Solution: Update to version 8.9.16, 9.0.14, 9.1.9 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-33829 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.