Medium CVE-2014-5191 EUVD-2014-5089GHSA-v27h-j97p-wqmx

The Preview plugin in CKEditor allows Cross-site scripting (XSS)

Published Aug 7, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Package: ckeditor Package: ckeditor/ckeditor Package: ckeditor3 Ecosystem: Debian Ecosystem: Packagist

Description

Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	ckeditor	4.4.4+dfsg1-1	—
Debian 12	ckeditor3	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	ckeditor/ckeditor	< 4.4.3	4.4.3	GHSA-v27h-j97p-wqmx

References

http://ckeditor.com/node/136981
60036 third-party-advisory
69161 vdb-entry