GitHub Advisoryadvisory · npm

GHSA-q9w4-w667-qqj4 ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor

MEDIUM Published 2023-07-10 Modified 2023-07-21 Official page ↗
Aliases
CVE-2023-37905
Ecosystem
npm
Packages
ckeditor-wordcount-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-10

Affected packages

• npm ckeditor-wordcount-plugin: < 1.17.12 → fixed in 1.17.12

Description

Problem It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. Solution Update to version 1.17.12 of the `ckeditor-wordcount-plugin` plugin. Credits • @sypets for reporting this finding to the TYPO3 Security Team • @ohader for fixing the issue on behalf of the TYPO3 Security Team

Related

Alias · CVE (1)

  • CVE-2023-37905 ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References