Cross-site scripting in CKEditor - CVE-2018-17960

Vulnerability identifier: #VU31182

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2018-17960

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

CKEditor
otrs (Alpine package)
ckeditor
Fedora
PeopleSoft Enterprise PeopleTools
IBM Engineering Requirements Management DOORS Next
Engineering Workflow Management

Install update from vendor's website.

CKEditor - update to 4.11.0
otrs (Alpine package) - update to 6.0.33-r0
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
ckeditor - addressed in versions 4.11.2-1.fc28, 4.11.2-1.fc29, 4.11.2-2.el6, 4.11.2-2.el7
Engineering Workflow Management - addressed in versions 7.0.1 iFix021, 7.0.2 iFix021

• http://www.securityfocus.com/bid/109205
• https://ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-link-on-typing-released/
• https://ckeditor.com/cke4/release/CKEditor-4.11.0
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

• Cross-site scripting in CKSource CKEditor
• Cross-site scripting in otrs (Alpine package)
• Multiple vulnerabilities in IBM Engineering Workflow Management (EWM)
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Fedora 28 update for ckeditor
• Fedora 29 update for ckeditor
• Fedora EPEL 7 update for ckeditor
• Fedora EPEL 6 update for ckeditor
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools