PT-2023-30581 · Cksource+1 · Ckeditor+1

Rafael Pedrero · Published 2023-11-16 · Updated 2024-02-07 · CVE-2023-4771

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor versions 4.15.1 and earlier CKEditor versions prior to 4.24.0-lts

Description A Cross-Site scripting issue has been found in CKSource CKEditor. An attacker could send malicious javascript code through the "samples/old/ajax.html" file and retrieve an authorized user's information. The vulnerability affects all users using the CKEditor 4 where the samples/old/ajax.html file is used in a production environment.

Recommendations For versions 4.15.1 and earlier, update to version 4.24.0-lts or later to resolve the issue. As a temporary workaround, consider restricting access to the samples/old/ajax.html file until a patch is available. Avoid using the samples/old/ajax.html file in production environments until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-4771

GHSA-HXJC-9J8V-V9PR

GHSA-WH5W-82F3-WRXH

Affected Products

Ckeditor

Debian

References · 16

• 🔥 https://github.com/sahar042/CVE-2023-4771 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4771 · Security Note
• https://ubuntu.com/security/CVE-2023-4771 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-4771 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-4771 · Security Note
• https://osv.dev/vulnerability/GHSA-hxjc-9j8v-v9pr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wh5w-82f3-wrxh · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-4771 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4771 · Vendor Advisory
• https://github.com/ckeditor/ckeditor4 · Note
• https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb · Note
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-wh5w-82f3-wrxh · Note
• https://github.com/ckeditor/ckeditor4-releases · Note
• https://incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor · Note