CVE-2024-45400CWE-79

CKEditor Open Link plugin vulnerable to Cross-site Scripting

Medium · published September 5, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link in a new tab. A vulnerability in versions of the plugin prior to 1.0.7 allowed a user to execute JavaScript code by abusing the link href attribute. The fix is available starting with version 1.0.7.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-09-05T23:23Z
EPSS history
Timeline
  • 05 SEP 23:23Z
    CKEditor Open Link plugin vulnerable to Cross-site Scripting
    cvelistv5