CVE-2014-5191: The Preview plugin in CKEditor allows Cross-site scripting (XSS)
Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Other sources
The Preview plugin in CKEditor allows Cross-site scripting (XSS)
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/ckeditor/ckeditorto a version that resolves this vulnerability.Fixed in 4.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5191?
CVE-2014-5191 is considered a critical vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2014-5191?
To fix CVE-2014-5191, upgrade CKEditor to version 4.4.3 or later.
What types of attacks can CVE-2014-5191 enable?
CVE-2014-5191 can enable attackers to inject arbitrary web scripts or HTML into web pages viewed by other users.
Which versions of CKEditor are affected by CVE-2014-5191?
The affected versions of CKEditor are all versions before 4.4.3, specifically 4.4.0, 4.4.1, and 4.4.2.
Is there any workaround for CVE-2014-5191?
There are no specific workarounds for CVE-2014-5191; the recommended action is to upgrade to a patched version.