PT-2024-20582 · Ckeditor4+3 · Ckeditor4+3

Michal Frýba · Published 2024-02-07 · Updated 2025-02-06 · CVE-2024-24815

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor4 versions prior to 4.24.0-lts

Description A cross-site scripting vulnerability has been discovered in the core HTML parsing module of CKEditor4. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration, which defaults to script and style elements. The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor.

Recommendations For versions prior to 4.24.0-lts, update to version 4.24.0-lts to resolve the issue. As a temporary workaround, consider disabling full-page editing mode or restricting the use of CDATA elements in Advanced Content Filtering configuration to minimize the risk of exploitation. Avoid using the script and style elements in the affected configuration until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-24815

GHSA-FQ6H-4G8V-QQVM

OPENSUSE-SU-2024:14557-1

OPENSUSE-SU-2025:0008-1

USN-7258-1

Affected Products

Ckeditor4

Debian

Linuxmint

Ubuntu

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24815.json · Exploit
• https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb · Patch
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24815 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-24815 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-24815 · Security Note
• https://ubuntu.com/security/CVE-2024-43411 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7258-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fq6h-4g8v-qqvm · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14557-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0008-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24728 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-24815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24815 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-24815 · Vendor Advisory