PT-2020-4408 · Cksource+2 · Ckeditor+2

Published 2020-03-06 · Updated 2024-03-06 · CVE-2020-9281

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: CKEditor versions 4.0 through 4.14

Description: A cross-site scripting (XSS) issue exists due to insufficient input validation in the HTML Data Processor for CKEditor. This allows remote attackers to inject arbitrary web script through a crafted "protected" comment using the cke protected syntax. The vulnerability can be exploited by sending a specially formed comment, enabling attackers to perform cross-site scripting attacks.

Recommendations: For CKEditor versions 4.0 through 4.14, update to version 4.14 or later to resolve the issue. As a temporary workaround, consider disabling the HTML Data Processor or restricting the use of "protected" comments until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-04936

BIT-DRUPAL-2020-9281

CVE-2020-9281

GHSA-VCJF-MGCG-JXJQ

USN-5340-1

USN-5340-2

Affected Products

Ckeditor

Linuxmint

Ubuntu

References · 31

• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5340-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5340-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33829 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE · Vendor Advisory
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://ubuntu.com/security/CVE-2018-9861 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2020-9281 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32808 · Vendor Advisory