Description
A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | ckeditor | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ckeditor | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ckeditor | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ckeditor | No fix yet | — |
References
- https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-released/#security-issues-fixed
- FEDORA-2020-8d5de93970 vendor-advisory
- FEDORA-2020-261449d821 vendor-advisory
- FEDORA-2020-a832c215bf vendor-advisory