要点
- CVE-2023-37905 是影响 ckeditor-wordcount-plugin (ckeditor-wordcount-plugin project), ckeditor-wordcount-plugin 的中危 (CVSS 6.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.57%，高于 47.3% 的漏洞。
- 修复：升级到 1.17.12 或更高版本。
Description
Problem
It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.
Solution
Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin.
Credits
- @sypets for reporting this finding to the TYPO3 Security Team
- @ohader for fixing the issue on behalf of the TYPO3 Security Team
NVD description
ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free