CVE-2020-9281 - 漏洞详情

CVE-2020-9281 (CNNVD-202003-260)

MEDIUM

中文标题:

CKEditor 跨站脚本漏洞

英文标题:

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 a...

CVSS分数: 6.1

发布时间: 2020-03-07 00:02:27

漏洞类型: 跨站脚本

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

CKEditor是一套开源的、基于网页的文字编辑器。HTML Data Processor是其中的一个HTML数据处理器。 CKEditor 4.14之前的4.0版本中的HTML Data Processor存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。

英文描述:

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

CWE类型:

CWE-79

受影响产品

厂商	产品	版本	版本范围	平台	CPE
ckeditor	ckeditor	*	-	-	`cpe:2.3:a:ckeditor:ckeditor::::::::`
fedoraproject	fedora	30	-	-	`cpe:2.3:o:fedoraproject:fedora:30:::::::*`
fedoraproject	fedora	31	-	-	`cpe:2.3:o:fedoraproject:fedora:31:::::::*`
fedoraproject	fedora	32	-	-	`cpe:2.3:o:fedoraproject:fedora:32:::::::*`
drupal	drupal	*	-	-	`cpe:2.3:a:drupal:drupal::::::::`
oracle	agile_plm	9.3.5	-	-	`cpe:2.3:a:oracle:agile_plm:9.3.5:::::::*`
oracle	agile_plm	9.3.6	-	-	`cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*`
oracle	application_express	*	-	-	`cpe:2.3:a:oracle:application_express::::::::`
oracle	jd_edwards_enterpriseone_tools	*	-	-	`cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::`
oracle	peoplesoft_enterprise_peopletools	-	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:-:::::::*`
oracle	peoplesoft_enterprise_peopletools	8.56	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:::::::*`
oracle	peoplesoft_enterprise_peopletools	8.57	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:::::::*`
oracle	peoplesoft_enterprise_peopletools	8.58	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::*`
oracle	siebel_apps_-_customer_order_management	*	-	-	`cpe:2.3:a:oracle:siebel_apps_-_customer_order_management::::::::`
oracle	webcenter_portal	11.1.1.9.0	-	-	`cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:::::::*`
oracle	webcenter_portal	12.2.1.3.0	-	-	`cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:::::::*`
oracle	webcenter_portal	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:::::::*`
oracle	banking_enterprise_default_management	2.6.2	-	-	`cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:::::::*`
oracle	banking_enterprise_default_management	2.7.0	-	-	`cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:::::::*`
oracle	banking_enterprise_default_management	2.7.1	-	-	`cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:::::::*`
oracle	banking_enterprise_default_management	2.10.0	-	-	`cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:::::::*`
oracle	banking_enterprise_default_management	2.12.0	-	-	`cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:::::::*`
oracle	banking_enterprise_default_managment	*	-	-	`cpe:2.3:a:oracle:banking_enterprise_default_managment::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

FEDORA-2020-8d5de93970 vendor-advisory
cve.org

访问

FEDORA-2020-261449d821 vendor-advisory
cve.org

访问

FEDORA-2020-a832c215bf vendor-advisory
cve.org

访问