GitHub Advisoryadvisory · npm

GHSA-mw2c-vx6j-mg76 CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature

MEDIUM Published 2024-02-07 Modified 2024-03-01 Official page ↗
Aliases
CVE-2024-24816
Ecosystem
npm
Packages
ckeditor4
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-02-07

Affected packages

• npm ckeditor4: < 4.24.0-lts → fixed in 4.24.0-lts

Description

Affected packages The vulnerability has been discovered in the samples that use the preview feature: • `samples/old/**/*.html` • `plugins/[plugin name]/samples/**/*.html` All integrators that use these samples in the production code can be affected. Impact A potential vulnerability has been discovered in one of CKEditor's 4 samples that are shipped with production code. The vulnerability allowed to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. Patches The problem has been recognized and patched. The fix will be available in version 4.24.0-lts. For more information Email us at [email protected] if you have any questions or comments about this advisory. Acknowledgements The CKEditor 4 team would like to thank Marcin Wyczechowski & Michał Majchrowicz AFINE Team for recognizing and reporting this vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-24816 CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References