Ckeditor XSS Vulnerability

Description

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Recommendation

Update the ckeditor package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.11.0
• Patched version(s): 4.11.0

References

• GHSA-g68x-vvqq-pvw3
• ckeditor.com
• www.oracle.com
• web.archive.org
• typo3.org
• CVE-2018-17960
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• SimpleMDE XSS Vulnerability - CVE-2018-19057
• Simditor XSS Vulnerability - CVE-2018-6464
• XSS vulnerability that affects bootstrap - CVE-2018-20676
• XSS vulnerability that affects bootstrap - bootstrap - CVE-2018-20676

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

ckeditor