GHSA-v273-j5hq-26xp: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-v273-j5hq-26xp) affects Drupal core's implementation of the CKEditor library. This moderately critical security issue was disclosed on March 18, 2020, affecting Drupal versions 8.0.0 through 8.7.12 and 8.8.0 through 8.8.4. The vulnerability is related to the third-party WYSIWYG CKEditor library integration within Drupal core (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.2 (Moderate severity) with the following vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. This indicates a network-based attack vector with high complexity, requiring no privileges but user interaction, with unchanged scope and low impact on confidentiality and integrity, with no impact on availability (GitHub Advisory).

The vulnerability could allow an attacker who can create or edit content to execute Cross Site Scripting (XSS) attacks targeting users with access to the WYSIWYG CKEditor, including site administrators with privileged access (GitHub Advisory).

The vulnerability is exploitable in configurations where Drupal is configured to use the WYSIWYG CKEditor for site users. The attack requires high complexity and user interaction to be successful (GitHub Advisory).

The vulnerability has been patched in Drupal versions 8.7.12 and 8.8.4. The fix involves updating the CKEditor library to version 4.14 to mitigate the vulnerabilities (GitHub Advisory, PHP Security).