GHSA-cfcv-q4qq-2ph4 CKEditor 4 vulnerabilities in versions <4.16.1
Cross-site scripting vulnerabilities in CKEditor 4 allow attackers to execute arbitrary scripts in the context of other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-cfcv-q4qq-2ph4?
GHSA-cfcv-q4qq-2ph4 is a cross-site scripting vulnerability in pimcore/pimcore, published on 23 Aug 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Details see:
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg ( CVE-2021-32809 )
Which versions are affected by GHSA-cfcv-q4qq-2ph4?
2 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 10.1.1 |
pimcore/pimcore Packagist | All versions | 10.1.1 |
How do I fix GHSA-cfcv-q4qq-2ph4?
Upgrade pimcore/pimcore to 10.1.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-cfcv-q4qq-2ph4 being exploited?
There is no known exploitation of GHSA-cfcv-q4qq-2ph4 in the wild and no public exploit code.