CVE-2020-9281
MediumCVSS 6.1Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
CKEditor 4.0 before 4.14 contains a cross-site scripting (XSS) vulnerability in the HTML Data Processor. A remote attacker can inject arbitrary script through a crafted "protected" comment (with the cke_protected syntax).
Risk Assessment
An attacker can execute script in the victim's browser, potentially leading to session theft, account takeover, or content modification.
Recommendation
Update CKEditor to version 4.14 or later to mitigate the vulnerability.
Other vulnerabilities in CKEditor
See all- CVE-2023-31541Critical
The CKEditor v1.2.3 plugin for Redmine has an unrestricted file upload vulnerability in the 'Browse and upload images' feature, allowing arbitrary files to be uploaded to the server.
- CVE-2021-26272Medium
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
- CVE-2021-26271Medium
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
- CVE-2020-27193Medium
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of the editor inputs.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS