4.25.0
5 years ago
3 months ago
Known vulnerabilities in the ckeditor4 package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
ckeditor4 is a JavaScript WYSIWYG web text editor. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization via the How to fix Cross-site Scripting (XSS)? Upgrade | <4.25.0 |
ckeditor4 is a JavaScript WYSIWYG web text editor. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in an unlikely scenario where an attacker gains control over the How to fix Cross-site Scripting (XSS)? Upgrade | >=4.22.0 <4.25.0 |
ckeditor4 is a JavaScript WYSIWYG web text editor. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to incorrect CDATA detection in the HTML parsing module. This flaw allows for the injection of malformed HTML content that bypasses the Advanced Content Filtering mechanism, potentially leading to the execution of JavaScript code. An attacker could exploit this vulnerability by manipulating CDATA content detection to launch an attack on the editor. Note: This issue is particularly relevant for instances that have enabled full-page editing mode or have allowed CDATA elements in the Advanced Content Filtering configuration, which by default includes How to fix Cross-site Scripting (XSS)? Upgrade | <4.24.0 |
ckeditor4 is a JavaScript WYSIWYG web text editor. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to the misconfiguration of the Note: This issue affects samples that enable the preview feature, specifically within How to fix Cross-site Scripting (XSS)? Upgrade | <4.24.0 |
ckeditor4 is a JavaScript WYSIWYG web text editor. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the How to fix Cross-site Scripting (XSS)? Upgrade | <4.24.0 |