GHSA-m94c-37g6-cjhc

Suggest an improvement
Source
https://github.com/advisories/GHSA-m94c-37g6-cjhc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-m94c-37g6-cjhc/GHSA-m94c-37g6-cjhc.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-m94c-37g6-cjhc
Aliases
Published
2021-08-23T19:42:15Z
Modified
2023-11-01T05:19:26.564167Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Details

Affected packages

The vulnerability has been discovered in Fake Objects plugin. All plugins with Fake Objects plugin dependency are affected:

Impact

A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.

Patches

The problem has been recognized and patched. The fix will be available in version 4.16.2.

For more information

Email us at security@cksource.com if you have any questions or comments about this advisory.

Acknowledgements

The CKEditor 4 team would like to thank Mika Kulmala (kulmik) for recognizing and reporting this vulnerability.

Database specific 
{
    "nvd_published_at": "2021-08-13T00:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-23T17:15:12Z"
}
References

Affected packages

npm / ckeditor4

Package

Name
ckeditor4
View open source insights on deps.dev
Purl
pkg:npm/ckeditor4

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.16.2