NetSight
IP …
medium6.5

CVE-2022-24729

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

Impact

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Affected products

VendorProductAffected versions
CkeditorCkeditor
from 4.0 before 4.18.0
DrupalDrupal
from 8.0.0 before 9.2.15
from 9.3.0 before 9.3.8
OracleApplication Express
before 22.1.1
OracleCommerce Merchandising
Version 11.3.2
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.7.0.0 through 8.1.0.0.0
Versions 8.1.1.0, 8.1.2.0, 8.1.2.1
OracleFinancial Services Behavior Detection Platform
from 8.1.1.0 through 8.1.2.1
Versions 8.0.7.0, 8.0.8.0
OracleFinancial Services Trade-Based Anti Money Laundering
Versions 8.0.7, 8.0.8
OraclePeoplesoft Enterprise Peopletools
Versions 8.58, 8.59
FedoraprojectFedora
Versions 36, 37

Weakness classification

CWE-400CWE-1333

References