NetSight
IP …
medium5.4

CVE-2022-24728

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

Impact

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Affected products

VendorProductAffected versions
CkeditorCkeditor
from 4.0 before 4.18.0
DrupalDrupal
from 8.0.0 before 9.2.15
from 9.3.0 before 9.3.8
OracleApplication Express
before 22.1.1
OracleCommerce Merchandising
Version 11.3.2
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.7.0.0 through 8.1.0.0.0
Versions 8.1.1.0, 8.1.2.0, 8.1.2.1
OracleFinancial Services Behavior Detection Platform
from 8.1.1.0 through 8.1.2.1
Versions 8.0.7.0, 8.0.8.0
OracleFinancial Services Trade-Based Anti Money Laundering
Versions 8.0.7, 8.0.8
OraclePeoplesoft Enterprise Peopletools
Versions 8.58, 8.59
FedoraprojectFedora
Versions 36, 37

Weakness classification

CWE-79

References