PT-2022-5670 · Ckeditor4+1 · Ckeditor4+1

Published 2022-03-16 · Updated 2024-03-06 · CVE-2022-24729

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CKEditor4 versions prior to 4.18.0

Description The issue is related to the dialog plugin in CKEditor4, which contains a vulnerability allowing abuse of a dialog input validator regular expression. This can cause a significant performance drop, resulting in a browser tab freeze. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For CKEditor4 versions prior to 4.18.0, update to version 4.18.0 to resolve the issue. As a temporary workaround, consider disabling the dialog plugin until a patch is available. Restrict access to the dialog plugin to minimize the risk of exploitation. Avoid using the vulnerable regular expression in the dialog plugin until the issue is resolved. At the moment, there is no other information about additional workarounds.

Exploit

Fix

Resource Exhaustion

DoS

XSS

Weakness Enumeration

CWE-400

CWE-1333

CWE-79

Related Identifiers

BDU:2022-07065

BIT-DRUPAL-2022-24728

BIT-DRUPAL-2022-24729

CVE-2022-24729

DRUPAL-CORE-2022-005

GHSA-4FC4-4P5G-6W89

GHSA-F6RF-9M92-X2HH

Affected Products

Ckeditor4

Debian

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24729.json · Exploit
• https://drupal.org/sa-core-2022-005 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24729 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4fc4-4p5g-6w89 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24729 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP · Vendor Advisory
• https://ckeditor.com/cke4/release/CKEditor-4.18.0 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07065 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/BIT-drupal-2022-24728 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24728 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24729 · Vendor Advisory