GHSA-hxjc-9j8v-v9pr
First published: Thu Nov 16 2023(Updated: )
A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /`ckeditor/samples/old/ajax.html` file and retrieve an authorized user's information.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/ckeditor4 | <=4.15.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this CKEditor vulnerability?
The vulnerability ID for this CKEditor vulnerability is GHSA-hxjc-9j8v-v9pr.
What is the severity of the CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr)?
The severity of the CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr) is medium.
How does the CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr) affect the software?
The CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr) affects versions 4.15.1 and earlier of CKSource CKEditor.
How can an attacker exploit the CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr)?
An attacker can exploit the CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr) by sending malicious JavaScript code through the /ckeditor/samples/old/ajax.html file to retrieve an authorized user's information.
Where can I find more information about the CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr)?
You can find more information about the CKEditor vulnerability (GHSA-hxjc-9j8v-v9pr) at the following references: [CVE-2023-4771](https://nvd.nist.gov/vuln/detail/CVE-2023-4771), [INCIBE CERT](https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor), [GitHub Advisory](https://github.com/advisories/GHSA-hxjc-9j8v-v9pr).
- collector/github-advisory-latest
- alias/GHSA-hxjc-9j8v-v9pr
- alias/CVE-2023-4771
- collector/github-advisory
- package-manager/npm