PT-2023-26174 · Ckeditor+1 · Ckeditor-Wordcount-Plugin+2

Sybille Peters · Published 2023-07-10 · Updated 2023-09-15 · CVE-2023-37905

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ckeditor-wordcount-plugin versions prior to 1.17.12

Description The ckeditor-wordcount-plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. In default scenarios, exploiting this vulnerability requires a valid backend user account. However, if custom plugins are used on the website frontend, which accept and reflect rich-text content submitted by users, no authentication is required.

Recommendations Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin. As a temporary workaround, consider disabling the plugin until a patch is available. Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30 that fix the problem described above.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-37905

GHSA-M8FW-P3CR-6JQC

GHSA-Q9W4-W667-QQJ4

Affected Products

Ckeditor4

Typo3

Ckeditor-Wordcount-Plugin

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37905.json · Exploit
• https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4 · Vendor Advisory
• https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/a4b154bdf35b3465320136fcb078f196b437c2f1 · Patch
• https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/0f03b3e5b7c1409998a13aba3a95396e6fa349d8 · Patch
• https://osv.dev/vulnerability/CVE-2023-37905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37905 · Security Note
• https://osv.dev/vulnerability/GHSA-q9w4-w667-qqj4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8fw-p3cr-6jqc · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-m8fw-p3cr-6jqc · Note
• https://github.com/w8tcha/CKEditor-WordCount-Plugin · Note
• https://typo3.org/security/advisory/typo3-core-sa-2023-004 · Note