CVE-2022-24728

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.754

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.2.5	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.2.0.2	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2	Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.0	Windows
Text editor which can be embedded into web pages (USN-7258-1) ckeditor_4.22.1+dfsg1-2ubuntu0.24.10.1_all.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234