CVEvulnerability
CVE-2022-24728
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-03-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
Affected configurations
• ckeditor ckeditor (>= 4.0 < 4.18.0)
• drupal drupal (>= 8.0.0 < 9.2.15)
• drupal drupal (>= 9.3.0 < 9.3.8)
• oracle application express (< 22.1.1)
• oracle commerce merchandising 11.3.2
• oracle financial services analytical applications infrastructure (>= 8.0.7.0.0 <= 8.1.0.0.0)
• oracle financial services analytical applications infrastructure 8.1.1.0
• oracle financial services analytical applications infrastructure 8.1.2.0
• oracle financial services analytical applications infrastructure 8.1.2.1
• oracle financial services behavior detection platform (>= 8.1.1.0 <= 8.1.2.1)
• oracle financial services behavior detection platform 8.0.7.0
• oracle financial services behavior detection platform 8.0.8.0
• oracle financial services trade-based anti money laundering 8.0.7
• oracle financial services trade-based anti money laundering 8.0.8
• oracle peoplesoft enterprise peopletools 8.58
• oracle peoplesoft enterprise peopletools 8.59
• fedoraproject fedora 36
• fedoraproject fedora 37
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://ckeditor.com/cke4/release/CKEditor-4.18.0 Release Notes, Vendor Advisory
- https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 Patch, Third Party Advisory
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ lists.fedoraproject.org
- https://www.drupal.org/sa-core-2022-005 Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://ckeditor.com/cke4/release/CKEditor-4.18.0 Release Notes, Vendor Advisory
- https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 Patch, Third Party Advisory
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ lists.fedoraproject.org
- https://www.drupal.org/sa-core-2022-005 Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory