CVE-2020-27193: CKEditor4 cross-site scripting in Color Dialog

CVE-2020-27193 · Severity: low · CVSS 3.1 · Published 2022-05-24

CKEditor 4 is a rich-text editor used in web applications to allow users to create and format HTML content. A cross-site scripting (XSS) vulnerability in the Color Dialog and Color History features allows attackers to inject malicious JavaScript code that executes in a user's browser if the user pastes crafted HTML. This could lead to theft of session cookies, account takeover, or defacement of content.

Technologies: CKEditor 4, ckeditor4 (npm). Vendors: CKEditor, npm.

Quick answers

Is CVE-2020-27193 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-27193 being exploited in the wild.
How severe is CVE-2020-27193?
Low severity, with a CVSS score of 3.1, published 24 May 2022.
Which products and versions are affected?
CKEditor 4 <= 4.15.0; ckeditor4 (npm) SEMVER:introduced=0,fixed=4.15.1.
Is there a fix for CVE-2020-27193?
Yes. ckeditor4 (npm): upgrade to 4.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-27193 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-27193?
Check whether you run CKEditor 4 or ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ckeditor4 (npm): upgrade to 4.15.1 or later
    npm install ckeditor4@4.15.1

Technical details

This is a classic cross-site scripting (XSS) vulnerability (CWE-79) in CKEditor 4's Color Dialog and Color History features. The root cause is improper neutralization of user-supplied HTML input during web page generation. An attacker must socially engineer a user into copying and pasting malicious HTML code into the Color Button dialog or related color input fields. The attack requires user interaction (paste action) and network reachability; no authentication is required. Upon successful exploitation, the attacker can execute arbitrary JavaScript in the context of the application, potentially stealing credentials, session tokens, or modifying page content. The vulnerability was patched in CKEditor 4.15.1, released in November 2020. CKEditor 4 reached end-of-life in June 2023, and security updates are only available through the Extended Support Model Package.

Affected products

  • CKEditor CKEditor 4 <= 4.15.0

Identifiers

  • CVE-2020-27193
  • GHSA-4m44-5j2g-xf64

Timeline

  • 2020-11-12: disclosed: Vulnerability disclosed and reported to NVD
  • 2020-11-09: patched: Fixed in CKEditor 4.15.1 released November 9, 2020
  • 2022-05-24: advisory: GitHub advisory GHSA-4m44-5j2g-xf64 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.