Is CVE-2018-11093 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-11093 being exploited in the wild.

How severe is CVE-2018-11093?

Low severity, with a CVSS score of 3.1, published 23 May 2018.

Which products and versions are affected?

Ckeditor5-Link 0.3.0 before 10.0.1; @ckeditor/ckeditor5-link (npm) SEMVER:introduced=0.3.0,fixed=10.0.1.

Is there a fix for CVE-2018-11093?

Yes. @ckeditor/ckeditor5-link (npm): upgrade to 10.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-11093 attacked?

It is attacked over the network.

Am I affected by CVE-2018-11093?

Check whether you run Ckeditor5-Link or @ckeditor/ckeditor5-link (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-11093: CKEditor ckeditor5-link cross-site scripting in link preview

CVE-2018-11093 · Severity: low · CVSS 3.1 · Published 2018-05-23

CKEditor's link module contains a cross-site scripting (XSS) vulnerability in its link preview feature. An attacker can inject malicious JavaScript code through a crafted link, which executes when a user views the link preview in the editor. This could allow attackers to steal sensitive data from the editor or perform actions on behalf of the user within the editing application.

Vendors: CKEditor, npm.

Quick answers

Is CVE-2018-11093 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-11093 being exploited in the wild.
How severe is CVE-2018-11093?: Low severity, with a CVSS score of 3.1, published 23 May 2018.
Which products and versions are affected?: Ckeditor5-Link 0.3.0 before 10.0.1; @ckeditor/ckeditor5-link (npm) SEMVER:introduced=0.3.0,fixed=10.0.1.
Is there a fix for CVE-2018-11093?: Yes. @ckeditor/ckeditor5-link (npm): upgrade to 10.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-11093 attacked?: It is attacked over the network.
Am I affected by CVE-2018-11093?: Check whether you run Ckeditor5-Link or @ckeditor/ckeditor5-link (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@ckeditor/ckeditor5-link (npm): upgrade to 10.0.1 or later
```
npm install @ckeditor/ckeditor5-link@10.0.1
```

Technical details

The vulnerability is a DOM-based cross-site scripting (CWE-79) flaw in the _createPreviewButton() function of @ckeditor/ckeditor5-link versions prior to 10.0.1. The function fails to sanitize the href attribute when creating an anchor tag for the link preview, allowing arbitrary HTML/JavaScript injection. The attack vector is network-based and requires user interaction (viewing a crafted link preview). An attacker can inject JavaScript via a malicious href attribute that executes in the victim's browser context. The fix involves sanitizing the href attribute using an ensureSafeUrl utility function; the patch is available in version 10.0.1 and later.

Affected products

CKEditor ckeditor5-link 0.3.0 before 10.0.1

Identifiers

CVE-2018-11093
GHSA-gvpx-9459-w3mj

Timeline

2018-05-23: disclosed
2018-05-22: patched: Fix committed to repository

References

https://github.com/ckeditor/ckeditor5-link/commit/8cb782eceba10fc481e4021cb5d25b2a85d1b04e

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.