CVE-2022-48110 Cross-site scripting in n/a

What is CVE-2022-48110?

CVE-2022-48110 is a medium-severity cross-site scripting vulnerability in n/a, published on 13 Feb 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).

Weakness: CWE-79

Which versions are affected by CVE-2022-48110?

It affects 1 product.

Products include Ckeditor Ckeditor.

How do I fix CVE-2022-48110?

No fix has been published for CVE-2022-48110 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-48110 being exploited?

There is no known exploitation of CVE-2022-48110 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2023-31541 File upload in n/a Critical 9.8
• CVE-2021-41164 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML High 8.2
• CVE-2021-41165 HTML comments vulnerability allowing to execute JavaScript code High 8.2
• CVE-2021-32808 Cross-site scripting in ckeditor via abuse of undo functionality High 7.6
• CVE-2011-4972 Missing authorization in CKEditor Drupal module High 7.5

Sources

• CVE record
• NVD
• OSV
• How this page is made