CVE-2022-24728
Published: 16 March 2022
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
Notes
| Author | Note |
|---|---|
| sbeattie | embedded copies of ckeditor are in ldap-account-manager, rt4, and rt5 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
ckeditor Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| xenial |
Needs triage
|
|
| bionic |
Needs triage
|
|
| focal |
Needs triage
|
|
| impish |
Ignored
(end of life)
|
|
| upstream |
Needs triage
|
|
| jammy |
Needs triage
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| lunar |
Needs triage
|
|
| mantic |
Needs triage
|
|
|
ckeditor3 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| impish |
Ignored
(end of life)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support)
|
|
| jammy |
Needs triage
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| lunar |
Needs triage
|
|
| mantic |
Needs triage
|
|
|
ldap-account-manager Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| impish |
Ignored
(end of life)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Needs triage
|
|
| jammy |
Needs triage
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| lunar |
Needs triage
|
|
| mantic |
Needs triage
|
|
|
request-tracker4 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| impish |
Ignored
(end of life)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Needs triage
|
|
| jammy |
Needs triage
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| lunar |
Needs triage
|
|
| mantic |
Needs triage
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.4 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |