PT-2024-30569 · Cksource+2 · Ckeditor4+2

Jacekbogdanski · Published 2024-08-21 · Updated 2025-02-06 · CVE-2024-43411

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions CKEditor4 versions 4.22 through 4.24

Description A theoretical issue has been identified in CKEditor4. In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor4 instances. The issue impacts only editor instances with enabled version notifications. This feature is disabled by default in all CKEditor4 LTS versions.

Recommendations For CKEditor4 versions 4.22 through 4.24, update to version 4.25.0-lts to resolve the issue. As a temporary workaround, consider disabling the version notifications feature until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43411

GHSA-6V96-M24V-F58J

USN-7258-1

Affected Products

Ckeditor4

Linuxmint

Ubuntu

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43411.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43411 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-43411 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43411 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7258-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6v96-m24v-f58j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43411 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7258-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28439 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43411 · Security Note
• https://ubuntu.com/security/CVE-2022-24728 · Vendor Advisory
• https://github.com/ckeditor/ckeditor4 · Note