Ckeditor XSS Vulnerability
Impact
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, it is recommended to upgrade to the latest editor version.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 4.11.0Semantic versions | 4.11.0 |
Version evidence: OSV · GHSA-g68x-vvqq-pvw3
View original version evidence (0 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 8.0.0 before 8.7.21Ecosystem versions | 8.7.21 |
| From 9.0.0 before 9.5.2Ecosystem versions | 9.5.2 |
Version evidence: OSV · GHSA-g68x-vvqq-pvw3
View original version evidence (25 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 8.0.0 before 8.7.21Ecosystem versions | 8.7.21 |
| From 9.0.0 before 9.5.2Ecosystem versions | 9.5.2 |
Version evidence: OSV · GHSA-g68x-vvqq-pvw3
View original version evidence (47 explicit versions)
Original source description
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, it is recommended to upgrade to the latest editor version.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2018-17960
- Source reference ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-link-on-typing-released
- Source reference ckeditor.com/cke4/release/CKEditor-4.11.0
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2018-17960.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2018-17960.yaml
- Security advisory github.com/advisories/GHSA-g68x-vvqq-pvw3
- Security advisory typo3.org/security/advisory/typo3-core-sa-2018-005
- Security advisory web.archive.org/web/20200227030123/http://www.securityfocus.com/bid/109205
- Security advisory www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html