Описание
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 4.5.7+dfsg-2ubuntu0.18.04.1 |
| devel | not-affected | 4.16.2+dfsg-1 |
| eoan | ignored | end of life |
| esm-apps/bionic | released | 4.5.7+dfsg-2ubuntu0.18.04.1 |
| esm-apps/focal | released | 4.12.1+dfsg-1ubuntu0.1 |
| esm-apps/jammy | not-affected | 4.16.2+dfsg-1 |
| esm-apps/xenial | released | 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 |
| esm-infra-legacy/trusty | DNE | |
| focal | released | 4.12.1+dfsg-1ubuntu0.1 |
| groovy | ignored | end of life |
Показывать по
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3
Связанные уязвимости
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
CKEditor 4.0 vulnerability in the HTML Data Processor
Уязвимость WYSIWYG-редактора Ckeditor, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю осуществлять межсайтовые сценарные атаки
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3