CVE-2018-17960: XSS

Reference Links

• https://typo3.org/security/advisory/typo3-core-sa-2018-005
• http://www.securityfocus.com/bid/109205
• https://ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-link-on-typing-released/
• https://ckeditor.com/cke4/release/CKEditor-4.11.0
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• https://nvd.nist.gov/vuln/detail/CVE-2018-17960
• https://github.com/advisories/GHSA-g68x-vvqq-pvw3 (Advisory)
• https://web.archive.org/web/20200227030123/http://www.securityfocus.com/bid/109205
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2018-17960.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2018-17960.yaml
• https://exchange.xforce.ibmcloud.com/vulnerabilities/153156
• https://www.ibm.com/support/pages/node/7124058

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6520510

Frequently Asked Questions

• What is CVE-2018-17960?

  CVE-2018-17960 is a vulnerability in CKEditor 4.x that allows user-assisted cross-site scripting (XSS) attacks.

• How does CVE-2018-17960 work?

  CVE-2018-17960 allows an attacker to execute XSS inside the CKEditor source area by persuading the victim to switch to source mode and paste a specially crafted HTML code.

• Which software versions are affected by CVE-2018-17960?

  CVE-2018-17960 affects TYPO3 CMS versions 8.0.0 to 8.7.21 and 9.0.0 to 9.5.2, as well as CKEditor versions up to 4.11.0.

• What is the severity of CVE-2018-17960?

  CVE-2018-17960 has a severity rating of 6.1 (medium).

• How can I fix CVE-2018-17960?

  To fix CVE-2018-17960, you should update CKEditor to version 4.11.0 or later.