CVE-2024-24816: Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature
Affected packages The vulnerability has been discovered in the samples that use the preview feature:
samples/old//.html plugins/[plugin name]/samples//.html
All integrators that use these samples in the production code can be affected.
Impact
A potential vulnerability has been discovered in one of CKEditor's 4 samples that are shipped with production code. The vulnerability allowed to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment.
Patches The problem has been recognized and patched. The fix will be available in version 4.24.0-lts.
For more information Email us at security@cksource.com if you have any questions or comments about this advisory.
Acknowledgements The CKEditor 4 team would like to thank Marcin Wyczechowski & Michał Majchrowicz AFINE Team for recognizing and reporting this vulnerability.
Other sources
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the preview feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24816?
CVE-2024-24816 has a medium severity rating due to potential security compromises in applications using specific CKEditor 4 samples.
How do I fix CVE-2024-24816?
To fix CVE-2024-24816, upgrade CKEditor to version 4.24.0-lts or later.
What software versions are affected by CVE-2024-24816?
CVE-2024-24816 affects all CKEditor versions from 4.0 up to, but not including, 4.24.0.
Which CKEditor feature does CVE-2024-24816 impact?
CVE-2024-24816 impacts the preview feature in CKEditor 4 when using specific sample files.
Is there a specific package to update for CVE-2024-24816?
The specific package to update for CVE-2024-24816 is the ckeditor4 package.