A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote     attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into     the editor. (CVE-2020-9440)

Note that Nessus relies on the presence of the package as reported by the vendor.

## CKEditor 4.14

**Security Updates:**

  -     [CVE-2020-9281](https://nvd.nist.gov/vuln/detail/CVE-202     0-9281) Fixed XSS vulnerability in the HTML data     processor reported by [Micha&#x142;
    Bentkowski](https://twitter.com/securitymb) of     Securitum.

&#9;Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode or (i) copy the specially crafted HTML code, prepared by the attacker and (ii) paste it into CKEditor in WYSIWYG mode.

  -     [CVE-2020-9440](https://nvd.nist.gov/vuln/detail/CVE-202     0-9440) Fixed XSS vulnerability in the WebSpellChecker     Dialog plugin reported by [Pham Van     Khanh](https://twitter.com/rskvp93) from Viettel Cyber     Security.

&#9;Issue summary: It was possible to execute XSS using CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, then (iii) switch back to WYSIWYG mode, and (iv) preview CKEditor content outside CKEditor editable area.

**An upgrade is highly recommended!**

New features :

  -     [#2374](https://github.com/ckeditor/ckeditor4/issues/237     4): Added support for pasting rich content from     LibreOffice Writer with the [Paste from     LibreOffice](https://ckeditor.com/cke4/addon/pastefromli     breoffice) plugin.

  -     [#2583](https://github.com/ckeditor/ckeditor4/issues/258     3): Changed     [emoji](https://ckeditor.com/cke4/addon/emoji)     suggestion box to show the matched emoji name instead of     an ID.

  -     [#3748](https://github.com/ckeditor/ckeditor4/issues/374     8): Improved the [color     button](https://ckeditor.com/cke4/addon/colorbutton)     state to reflect the selected editor content colors.

  -     [#3661](https://github.com/ckeditor/ckeditor4/issues/366     1): Improved the     [Print](https://ckeditor.com/cke4/addon/print) plugin to     respect styling rendered by the     [Preview](https://ckeditor.com/cke4/addon/preview)     plugin.

  -     [#3547](https://github.com/ckeditor/ckeditor4/issues/354     7): Active     [dialog](https://ckeditor.com/cke4/addon/dialog) tab now     has the `aria-selected='true'` attribute.

  -     [#3441](https://github.com/ckeditor/ckeditor4/issues/344     1): Improved     [`widget.getClipboardHtml()`](https://ckeditor.com/docs/     ckeditor4/latest/api/CKEDITOR_plugins_widget.html#method
    -getClipboardHtml) support for dragging and dropping     multiple     [widgets](https://ckeditor.com/cke4/addon/widget).

Fixed Issues :

  -     [#3587](https://github.com/ckeditor/ckeditor4/issues/358     7): [Edge, IE] Fixed:
    [Widget](https://ckeditor.com/cke4/addon/widget) with     form input elements loses focus during typing.

  -     [#3705](https://github.com/ckeditor/ckeditor4/issues/370     5): [Safari] Fixed: Safari incorrectly removes blocks     with the     [`editor.extractSelectedHtml()`](https://ckeditor.com/do     cs/ckeditor4/latest/api/CKEDITOR_editor.html#method-extr     actSelectedHtml) method after selecting all content.

  -     [#1306](https://github.com/ckeditor/ckeditor4/issues/130     6): Fixed: The     [Font](https://ckeditor.com/cke4/addon/font) plugin     creates nested HTML `<span>` tags when reapplying the     same font multiple times.

  -     [#3498](https://github.com/ckeditor/ckeditor4/issues/349     8): Fixed: The editor throws an error during the copy     operation when a     [widget](https://ckeditor.com/cke4/addon/widget) is     partially selected.

  -     [#2517](https://github.com/ckeditor/ckeditor4/issues/251     7): [Chrome, Firefox, Safari] Fixed: Inserting a new     image when the selection partially covers an existing     [enhanced image](https://ckeditor.com/cke4/addon/image2)     widget throws an error.

  -     [#3007](https://github.com/ckeditor/ckeditor4/issues/300     7): [Chrome, Firefox, Safari] Fixed: Cannot modify the     editor content once the selection is released over a     [widget](https://ckeditor.com/cke4/addon/widget).

  -     [#3698](https://github.com/ckeditor/ckeditor4/issues/369     8): Fixed: Cutting the selected text when a     [widget](https://ckeditor.com/cke4/addon/widget) is     partially selected merges paragraphs.

API Changes :

  -     [#3387](https://github.com/ckeditor/ckeditor4/issues/338     7): Added the     [CKEDITOR.ui.richCombo.select()](https://ckeditor.com/do     cs/ckeditor4/latest/api/CKEDITOR_ui_richCombo.html#metho     d-select) method.

  -     [#3727](https://github.com/ckeditor/ckeditor4/issues/372     7): Added new `textColor` and `bgColor` commands that     apply the selected color chosen by the [Color     Button](https://ckeditor.com/cke4/addon/colorbutton)     plugin.

  -     [#3728](https://github.com/ckeditor/ckeditor4/issues/372     8): Added new `font` and `fontSize` commands that apply     the selected font style chosen by the     [Font](https://ckeditor.com/cke4/addon/colorbutton)     plugin.

  -     [#3842](https://github.com/ckeditor/ckeditor4/issues/384     2): Added the     [`editor.getSelectedRanges()`](https://ckeditor.com/docs     /ckeditor4/latest/api/CKEDITOR_editor.html#method-getSel     ectedRanges) alias.

  -     [#3775](https://github.com/ckeditor/ckeditor4/issues/377     5): Widget     [mask](https://ckeditor.com/docs/ckeditor4/latest/api/CK     EDITOR_plugins_widget.html#property-mask) and     [parts](https://ckeditor.com/docs/ckeditor4/latest/api/C     KEDITOR_plugins_widget.html#property-parts) can now be     refreshed dynamically via API calls.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
263035	Linux Distros Unpatched Vulnerability : CVE-2020-9440	Nessus	Misc.	medium
134995	Fedora 31 : ckeditor (2020-a832c215bf)	Nessus	Fedora Local Security Checks	medium
134988	Fedora 30 : ckeditor (2020-261449d821)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-9440

medium

Tenable Plugins

medium

medium

medium