PT-2022-16835 · Unknown+3 · Ckeditor 4+3

Published 2022-03-16 · Updated 2025-02-06 · CVE-2022-24728

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions prior to 4.18.0

Description A vulnerability has been discovered in the core HTML processing module of CKEditor 4, which may affect all plugins used by the editor. This issue allows an attacker to inject malformed HTML, bypassing content sanitization, and potentially executing JavaScript code.

Recommendations For CKEditor 4 versions prior to 4.18.0, update to version 4.18.0 to resolve the issue. At the moment, there are no known workarounds for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DRUPAL-2022-24728

BIT-DRUPAL-2022-24729

CVE-2022-24728

DRUPAL-CORE-2022-005

GHSA-4FC4-4P5G-6W89

GHSA-F6RF-9M92-X2HH

USN-7258-1

Affected Products

Ckeditor 4

Debian

Linuxmint

Ubuntu

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24728.json · Exploit
• https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 · Patch
• https://drupal.org/sa-core-2022-005 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24729 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4fc4-4p5g-6w89 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24728 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24728 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43411 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7258-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24728 · Security Note
• https://ckeditor.com/cke4/release/CKEditor-4.18.0 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-24728 · Vendor Advisory