CVE-2018-11093
MEDIUM 6.1EPSS 1.0%
Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 1.00% chance of exploitation in the next 30 days, 62nd percentile
- Published
- 2018-05-22
- Updated
- 2024-08-05
Proof-of-concept exploits (1)
- ossf-cve-benchmark/CVE-2018-110930★ · 2020-12-01
Security advisories
- https://ckeditor.com/blog/CKEditor-5-v10.0.1-released
- ckeditor/ckeditor5-link/blob/master/CHANGELOG.md#1001-2018-05-22
- advisories/GHSA-gvpx-9459-w3mj