Kurz gesagt
- CVE-2023-37905 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in ckeditor-wordcount-plugin (ckeditor-wordcount-plugin project), ckeditor-wordcount-plugin.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.57%, höher als bei 47.3% aller Schwachstellen.
- Abhilfe: auf 1.17.12 oder neuer aktualisieren.
Description
Problem
It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.
Solution
Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin.
Credits
- @sypets for reporting this finding to the TYPO3 Security Team
- @ohader for fixing the issue on behalf of the TYPO3 Security Team
NVD description
ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free