CVE-2023-4771

🗓️ 16 Nov 2023 14:08:47Reported by INCIBEType

cve🔗 web.nvd.nist.gov👁 76 Views🌐 WEB

CKEditor XSS vulnerability in /ckeditor/samples/old/ajax.htm

Reporter	Title	Published	Views	Family All 24
GithubExploit	Exploit for Cross-site Scripting in Cksource Ckeditor	10 Jun 202408:19	–	githubexploit
IBM Security Bulletins	Security Bulletin: Due to the use of CKEditor, IBM Engineering Lifecycle Management - Jazz Foundation is affected by a Cross-Site scripting vulnerability	25 Sep 202507:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator is affected by multiple vulnerabilities in CKEditor	4 Dec 202415:19	–	ibm
CNNVD	CKEditor Security Vulnerabilities	16 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-4771 Cross-Site Scripting vulnerability in CKSource CKEditor	16 Nov 202314:08	–	cvelist
Debian CVE	CVE-2023-4771	16 Nov 202314:08	–	debiancve
Github Security Blog	Duplicate Advisory: CKEditor Cross-site Scripting vulnerability	16 Nov 202315:30	–	github
Github Security Blog	CKEditor cross-site scripting vulnerability in AJAX sample	7 Feb 202417:34	–	github
NVD	CVE-2023-4771	16 Nov 202314:15	–	nvd
OpenVAS	CKEditor < 4.24.0-lts Multiple XSS Vulnerabilities - Windows	20 Nov 202300:00	–	openvas

NVD

Vulners

Node

cksource ckeditorRange≤4.15.1wordpress

[
  {
    "defaultStatus": "unaffected",
    "product": "CKEditor",
    "vendor": "CKSource",
    "versions": [
      {
        "lessThanOrEqual": "4.15.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
incibe	www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor

Parameter	Position	Path	Description	CWE
html	nested	/ckeditor/samples/old/ajax.html	Cross-site scripting via CKEditor AJAX sample where user-supplied HTML content is assigned to innerHTML and rendered.	CWE-79
editorcontents	nested	/ckeditor/samples/old/ajax.html	Cross-site scripting via CKEditor AJAX sample where user-supplied HTML content is assigned to innerHTML and rendered.	CWE-79

17 Jun 2026 06:38Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1

EPSS0.00878

SSVC

CWE-79