CVE-2023-37905

Katalog CVE

CVSS 6.1 · Medium EPSS 0,57%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ckeditor-wordcount-plugin project ckeditor-wordcount-plugin. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

21 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4 advisory vendor
• https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/0f03b3e5b7c1409998a13aba3a95396e6fa349d8 patch
• https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/a4b154bdf35b3465320136fcb078f196b437c2f1 patch
• https://github.com/TYPO3/typo3/security/advisories/GHSA-m8fw-p3cr-6jqc
• https://typo3.org/security/advisory/typo3-core-sa-2023-004