CVE-2023-4771: Cross-Site Scripting vulnerability in CKSource CKEditor
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wh5w-82f3-wrxh. This link is maintained to preserve external references.
Original Description A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.
Other sources
Affected packages The vulnerability has been discovered in the AJAX sample available at the samples/old/ajax.html file location. All integrators that use that sample in the production code can be affected.
Impact
A potential vulnerability has been discovered in one of CKEditor's 4 samples that are shipped with production code. The vulnerability allowed to execute JavaScript code by abusing the AJAX sample. It affects all users using the CKEditor 4 at version < 4.24.0-lts where samples/old/ajax.html is used in a production environment.
Patches The problem has been recognized and patched. The fix will be available in version 4.24.0-lts.
For more information Email us at security@cksource.com if you have any questions or comments about this advisory.
Acknowledgements The CKEditor 4 team would like to thank Rafael Pedrero and INCIBE (original report) for recognizing and reporting this vulnerability.
— GitHub
A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of the Cross-Site Scripting vulnerability in CKSource CKEditor?
The vulnerability ID is CVE-2023-4771.
What is the severity rating of CVE-2023-4771?
The severity rating of CVE-2023-4771 is 6.1 (Medium).
Which versions of CKSource CKEditor are affected by CVE-2023-4771?
Versions 4.15.1 and earlier of CKSource CKEditor are affected by CVE-2023-4771.
How can an attacker exploit CVE-2023-4771?
An attacker can exploit CVE-2023-4771 by sending malicious javascript code through the /ckeditor/samples/old/ajax.html file.
How can I fix the Cross-Site Scripting vulnerability in CKSource CKEditor (CVE-2023-4771)?
To fix the vulnerability, it is recommended to upgrade CKSource CKEditor to version 4.15.2 or later.