Medium severity · published Feb 7, 2024
CVE-2024-24816
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
6.1
CVSS
1.7%
EPSS
No
On KEV
Description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CK
Ckeditor · Ckeditor
4.0 before 4.24.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-24816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-24816
Product
https://ckeditor.com/cke4/addon/preview
Patch
https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb
Vendor Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76
More from Ckeditor
9.8
CVE-2023-31541
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be…
7.5
CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
7.5
CVE-2011-4972
hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct…
6.5
CVE-2021-26272
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space…
6.5
CVE-2021-26271
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the…