Description

A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.

Remediation

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor

Related Vulnerabilities

CVE-2017-1000353 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2020-12668 Vulnerability in maven package com.hubspot.jinjava:jinjava

CVE-2017-16096 Vulnerability in npm package serveryaozeyan

CVE-2020-17519 Vulnerability in maven package org.apache.flink:flink-runtime_2.11

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth-parent

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory