Is CVE-2018-17960 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-17960 being exploited in the wild.

How severe is CVE-2018-17960?

Low severity, with a CVSS score of 3, published 21 November 2018.

Which products and versions are affected?

ckeditor (npm) SEMVER:introduced=0,fixed=4.11.0; Typo3 Cms-Core 8.0.0 to 8.7.20; 9.0.0 to 9.5.1.

Is there a fix for CVE-2018-17960?

Yes. ckeditor (npm): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-17960 attacked?

It is attacked over the network.

Am I affected by CVE-2018-17960?

Check whether you run ckeditor (npm) or Typo3 Cms-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-17960: CKEditor 4 XSS in source mode paste

CVE-2018-17960 · Severity: low · CVSS 3 · Published 2018-11-21

CKEditor is a widely-used rich-text editor component embedded in web applications and content management systems. This vulnerability allows an attacker to execute malicious JavaScript code (XSS) in a user's browser if the user can be tricked into switching to source mode, pasting attacker-supplied HTML, and then switching back to normal editing mode. While the attack requires user interaction and is considered unlikely, successful exploitation could lead to session hijacking, data theft, or malware distribution.

Technologies: Typo3 Cms-Core. Vendors: npm, Typo3.

Quick answers

Is CVE-2018-17960 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-17960 being exploited in the wild.
How severe is CVE-2018-17960?: Low severity, with a CVSS score of 3, published 21 November 2018.
Which products and versions are affected?: ckeditor (npm) SEMVER:introduced=0,fixed=4.11.0; Typo3 Cms-Core 8.0.0 to 8.7.20; 9.0.0 to 9.5.1.
Is there a fix for CVE-2018-17960?: Yes. ckeditor (npm): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-17960 attacked?: It is attacked over the network.
Am I affected by CVE-2018-17960?: Check whether you run ckeditor (npm) or Typo3 Cms-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ckeditor (npm): upgrade to 4.11.0 or later
```
npm install ckeditor@4.11.0
```

Technical details

This is a cross-site scripting (XSS) vulnerability in CKEditor 4's HTML parser. The root cause is insufficient sanitization of HTML content when pasted into source mode. An attacker can craft specially malicious HTML that bypasses the editor's XSS defenses when pasted into the source view. The attack requires: (1) network access to a web application using vulnerable CKEditor, (2) social engineering to convince a user to switch to source mode, paste the malicious HTML, and return to WYSIWYG mode, and (3) user interaction throughout. If successful, arbitrary JavaScript executes in the victim's browser with access to the page's DOM and user data. The vulnerability was fixed in CKEditor 4.11.0 (released November 2018) and patched versions of TYPO3 CMS.

Affected products

CKSource CKEditor 4 before 4.11.0
TYPO3 CMS Core 8.0.0 to 8.7.20; 9.0.0 to 9.5.1
TYPO3 CMS 8.0.0 to 8.7.20; 9.0.0 to 9.5.1

Identifiers

CVE-2018-17960
GHSA-g68x-vvqq-pvw3

Timeline

2018-11-21: disclosed: GHSA-g68x-vvqq-pvw3 published
2018-11: patched: CKEditor 4.11.0 released with fix; TYPO3 CMS Core 8.7.21 and 9.5.2 released

References

https://ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-link-on-typing-released

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.