PT-2024-1942 · Unknown+3 · Ckeditor 4+3

Marcin Wyczechowski + 1 · Published 2024-02-07 · Updated 2025-02-06 · CVE-2024-24816

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions prior to 4.24.0-lts

Description A cross-site scripting vulnerability has been discovered in CKEditor 4, affecting versions prior to 4.24.0-lts that use the preview feature. This vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment.

Recommendations For CKEditor 4 versions prior to 4.24.0-lts, update to version 4.24.0-lts to resolve the issue. As a temporary workaround, consider disabling the preview feature until a patch is available. Restrict access to the affected samples, such as samples/old/**/*.html and plugins/[plugin name]/samples/**/*.html, to minimize the risk of exploitation. Avoid using the misconfigured preview feature in production environments until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-01737

CVE-2024-24816

GHSA-MW2C-VX6J-MG76

USN-7258-1

Affected Products

Ckeditor 4

Debian

Linuxmint

Ubuntu

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24816.json · Exploit
• https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb · Patch
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24816 · Security Note
• https://ubuntu.com/security/CVE-2024-24815 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-24816 · Security Note
• https://bdu.fstec.ru/vul/2024-01737 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-24816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24816 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-24816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43411 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7258-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24816 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw2c-vx6j-mg76 · Vendor Advisory