Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZjamYtbWdjZy1qeGpx

CKEditor 4.0 vulnerability in the HTML Data Processor

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Permalink: https://github.com/advisories/GHSA-vcjf-mgcg-jxjq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZjamYtbWdjZy1qeGpx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: over 1 year ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00163
EPSS Percentile: 0.53515

Identifiers: GHSA-vcjf-mgcg-jxjq, CVE-2020-9281
References: Repository: https://github.com/ckeditor/ckeditor4
Blast Radius: 16.7

Affected Packages

npm:ckeditor4
Dependent packages: 26
Dependent repositories: 546
Downloads: 208,347 last month
Affected Version Ranges: < 4.14.0
Fixed in: 4.14.0
All affected versions: 4.13.0, 4.13.1
All unaffected versions: 4.14.0, 4.14.1, 4.15.0, 4.15.1, 4.16.0, 4.16.1, 4.16.2, 4.17.0, 4.17.1, 4.17.2, 4.18.0, 4.19.0, 4.19.1, 4.20.0, 4.20.1, 4.20.2, 4.21.0, 4.22.0, 4.22.1, 4.23.0, 4.24.0, 4.25.0