CVE-2018-17960
Fixed in a distro release EPSS 2%
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
Products: ckeditor
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | typo3/cms | 8.7.21 |
| Packagist | typo3/cms | 9.5.2 |
| Packagist | typo3/cms-core | 8.7.21 |
| Packagist | typo3/cms-core | 9.5.2 |
| npm | ckeditor | 4.11.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ckeditor | 4.11.1+dfsg-1 |
| Debian 12 | ckeditor3 | no fix |
| Ubuntu Pro 16.04 LTS | ckeditor | no fix |
| Ubuntu Pro 18.04 LTS | ckeditor | no fix |