← Back

CVE-2022-24728

nvd nist
Published: Mar 16, 2022Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Affected (18)

Show all products
Ckeditor: Ckeditor · Drupal: Drupal · Oracle: Application Express, Commerce Merchandising, Financial Services Analytical Applications Infrastructure, Financial Services Behavior Detection Platform, Financial Services Trade Based Anti Money Laundering, Peoplesoft Enterprise Peopletools · Fedoraproject: Fedora
Ckeditor
1 product
Ckeditor
Drupal
1 product
Drupal
Oracle
6 products
Application Express
Commerce Merchandising
Financial Services Analytical Applications Infrastructure
Financial Services Behavior Detection Platform
Financial Services Trade Based Anti Money Laundering
Peoplesoft Enterprise Peopletools
Fedoraproject
1 product
Fedora
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Ckeditor
From 4.0 to 4.18.0
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Drupal
Drupal
From 8.0.0 to 9.2.15
Drupal
From 9.3.0 to 9.3.8
Configuration C
13 vulnerable
Vulnerable SoftwareAffected Versions
Application Express
Before 22.1.1
Commerce Merchandising
Version 11.3.2
Oracle
Financial Services Analytical Applications Infrastructure
From 8.0.7.0.0 to 8.1.0.0.0
Financial Services Analytical Applications Infrastructure
Version 8.1.1.0
Financial Services Analytical Applications Infrastructure
Version 8.1.2.0
Financial Services Analytical Applications Infrastructure
Version 8.1.2.1
Oracle
Financial Services Behavior Detection Platform
From 8.1.1.0 to 8.1.2.1
Financial Services Behavior Detection Platform
Version 8.0.7.0
Financial Services Behavior Detection Platform
Version 8.0.8.0
Oracle
Financial Services Trade Based Anti Money Laundering
Version 8.0.7
Financial Services Trade Based Anti Money Laundering
Version 8.0.8
Oracle
Peoplesoft Enterprise Peopletools
Version 8.58
Peoplesoft Enterprise Peopletools
Version 8.59
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 36
Fedora
Version 37

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (14)

Source: security-advisories@github.com
Release NotesVendor Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Source: security-advisories@github.com
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.