Updated default CKEditor 4 library to the latest 4.24.0-lts. This version of the editor includes important security patches. From now on, all versions below 4.24.0-lts can no longer be considered as secure.
Security Updates:
Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection reported by Michal Frýba, ALEF NULA.
Issue summary: The vulnerability allowed to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. See GHA for more details.
Cross-site scripting (XSS) vulnerability in AJAX sample reported by Rafael Pedrero, see INCIBE report.
Issue summary: The vulnerability allowed to execute JavaScript code by abusing the AJAX sample. See GHA for more details.
Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature reported by Marcin Wyczechowski & Michał Majchrowicz, AFINE Team.
Issue summary: The vulnerability allowed to execute JavaScript code by abusing the misconfigured preview feature. See GHA for more details.
If you use the CKEditor LTS module for Drupal 7.x, upgrade to CKEditor 7.x-1.25
Important note: If you use the CKEditor CDN, it is highly recommended to update the CKEditor JavaScript library to the newest version. To do so, edit the "CKEditor Global profile" settings in admin panel, at /admin/config/content/ckeditor/editg.
The current version can be found at https://cdn.ckeditor.com/.