CVE-2020-9440: XSS
A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor.
Other sources
jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the HTML() function. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-9440?
CVE-2020-9440 is a vulnerability in jQuery that allows for cross-site scripting attacks.
How does CVE-2020-9440 work?
CVE-2020-9440 occurs due to improper validation of user-supplied input by the HTML() function in jQuery, which can be exploited by a remote attacker to execute scripts in a victim's browser within the context of the hosting website.
What is the severity level of CVE-2020-9440?
CVE-2020-9440 has a severity level of medium, with a CVSS score of 6.1.
How can I fix the vulnerability CVE-2020-9440?
To fix the vulnerability CVE-2020-9440, it is recommended to update to a patched version of jQuery that addresses the issue.
Where can I find more information about CVE-2020-9440?
You can find more information about CVE-2020-9440 on the IBM X-Force Exchange website at the following links: [CVE-2020-9440](https://exchange.xforce.ibmcloud.com/vulnerabilities/177487) and [CVE-2020-9440](https://exchange.xforce.ibmcloud.com/vulnerabilities/180875).