CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
References
| Link | Resource |
|---|---|
| https://ckeditor.com/cke4/release/CKEditor-4.18.0 | Release Notes Vendor Advisory |
| https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 | Patch Third Party Advisory |
| https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89 | Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ | |
| https://www.drupal.org/sa-core-2022-005 | Patch Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
07 Nov 2023, 03:44
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
08 Dec 2022, 22:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
14 Nov 2022, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Nov 2022, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Fedoraproject fedora
Oracle commerce Merchandising Oracle application Express Oracle financial Services Analytical Applications Infrastructure Fedoraproject Oracle Oracle financial Services Behavior Detection Platform Oracle peoplesoft Enterprise Peopletools Oracle financial Services Trade-based Anti Money Laundering |
|
| References | (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.7:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* |
24 Oct 2022, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jul 2022, 18:21
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Mar 2022, 13:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://ckeditor.com/cke4/release/CKEditor-4.18.0 - Release Notes, Vendor Advisory | |
| References | (CONFIRM) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89 - Third Party Advisory | |
| References | (CONFIRM) https://www.drupal.org/sa-core-2022-005 - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 - Patch, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
| First Time |
Drupal drupal
Drupal Ckeditor Ckeditor ckeditor |
|
| CPE | cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* |
16 Mar 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Mar 2022, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-16 16:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-24728
Mitre link : CVE-2022-24728
CVE.ORG link : CVE-2022-24728
JSON object : View
Products Affected
oracle
- financial_services_trade-based_anti_money_laundering
- financial_services_behavior_detection_platform
- financial_services_analytical_applications_infrastructure
- peoplesoft_enterprise_peopletools
- application_express
- commerce_merchandising
drupal
- drupal
ckeditor
- ckeditor
fedoraproject
- fedora
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')