CVE-2022-24728: Cross-site Scripting in CKEditor4
CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24728?
CVE-2022-24728 is a vulnerability in CKEditor4, an open source HTML editor, that allows for injection of malformed HTML.
Which software versions are affected by CVE-2022-24728?
CKEditor4 versions prior to 4.18.0, Drupal versions 8.0.0 to 9.2.15, Drupal versions 9.3.0 to 9.3.8, Oracle Application Express versions up to 22.1.1, Oracle Commerce Merchandising version 11.3.2, Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7.0.0 to 8.1.0.0.0, Oracle Financial Services Analytical Applications Infrastructure version 8.1.1.0, Oracle Financial Services Analytical Applications Infrastructure version 8.1.2.0, Oracle Financial Services Analytical Applications Infrastructure version 8.1.2.1, Oracle Financial Services Behavior Detection Platform versions 8.0.7.0 to 8.1.2.1, Oracle Financial Services Trade-based Anti Money Laundering version 8.0.7, Oracle Financial Services Trade-based Anti Money Laundering version 8.0.8, Oracle PeopleSoft Enterprise PeopleTools versions 8.58 to 8.59, Fedora versions 36 and 37.
What is the severity rating of CVE-2022-24728?
The severity rating of CVE-2022-24728 is medium with a CVSS score of 5.4.
How can I fix the CVE-2022-24728 vulnerability?
To fix the CVE-2022-24728 vulnerability, update CKEditor4 to version 4.18.0 or later.
Where can I find more information about CVE-2022-24728?
You can find more information about CVE-2022-24728 at the following references: [CKEditor-4.18.0](https://ckeditor.com/cke4/release/CKEditor-4.18.0), [GitHub Commit](https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949), [GitHub Security Advisories](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89)