Advisory Weakness Curation

Cross-Site Scripting in CKEditor4 WordCount Plugin > ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.4) ### Problem The WordCount https://ckeditor.com/cke4/addon/wordcount plugin (`npm:ckeditor-wordcount-plugin` https://www.npmjs.com/package/ckeditor-wordcount-plugin) for CKEditor4 is vulnerable to cross-site scripting when switching to the source code mode. This plugin is enabled via the `Full.yaml` configuration present, but is not active in the default configuration. In default scenarios, exploiting this vulnerability requires a valid backend user account. However, if custom plugins are used on the website frontend, which accept and reflect rich-text content submitted by users, no authentication is required. ### Solution Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30 that fix the problem described above. ### Credits Thanks to Sybille Peters who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue. ### References * TYPO3-CORE-SA-2023-004 https://typo3.org/security/advisory/typo3-core-sa-2023-004 * https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.

Cross-Site Scripting in CKEditor4 WordCount Plugin > ### CVSS: `.4) ### Problem The WordCount https://ckeditor.com/cke4/addon/wordcount plugin (`npm:ckeditor-wordcount-plugin` https://www.npmjs.com/package/ckeditor-wordcount-plugin) for CKEditor4 is vulnerable to cross-site scripting when switching to the source code mode. This plugin is enabled via the `Full.yaml` configuration present, but is not active in the default configuration. In default scenarios, exploiting this vulnerability requires a valid backend user account. However, if custom plugins are used on the website frontend, which accept and reflect rich-text content submitted by users, no authentication is required. ### Solution Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30 that fix the problem described above. ### Credits Thanks to Sybille Peters who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue. ### References * TYPO3-CORE-SA-2023-004 https://typo3.org/security/advisory/typo3-core-sa-2023-004 * https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4