要点
- CVE-2023-37905 は ckeditor-wordcount-plugin (ckeditor-wordcount-plugin project), ckeditor-wordcount-plugin に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.57%（全脆弱性の 47.3% より高い）。
- 対処：1.17.12 以降に更新してください。
概要
Problem
It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.
Solution
Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin.
Credits
- @sypets for reporting this finding to the TYPO3 Security Team
- @ohader for fixing the issue on behalf of the TYPO3 Security Team
NVD の説明
ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン