CVE-2023-28439 ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process

🗓️ 22 Mar 2023 20:55:00Reported by GoogleType

osv

osv🔗 osv.dev👁 17 Views

CKEditor4 Cross-Site Scripting Vulnerability in Iframe Dialog and Media Embed packages

Reporter	Title	Published	Views	Family All 52
Huntr	CKeditor 4.20.2 in use which is vulnerable to CVE-2023-28439	18 Apr 202314:37	–	huntr
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in its dependencies (CVE-2022-45688, CVE-2023-28439, CVE-2023-33201, CVE-2023-41900, CVE-2023-36479, CVE-2023-40167, CVE-2023-36478, )	24 Mar 202514:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator is affected by multiple vulnerabilities in CKEditor	4 Dec 202415:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Apache Axis, CKEditor4 & IBM MQ (CVE-2014-3596, CVE-2018-8032, CVE-2019-0227, CVE-2012-5784, CVE-2021-38986, CVE-2022-22321, CVE-2023-28439)	19 Mar 202515:11	–	ibm
BDU FSTEC	The vulnerability of the Iframe Dialog and Media Embed functions in CKEditor’s WYSIWYG editor allows a hacker to execute arbitrary JavaScript code.	7 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-28439	22 Mar 202323:36	–	circl
CNNVD	CKEditor 跨站脚本漏洞	22 Mar 202300:00	–	cnnvd
CVE	CVE-2023-28439	22 Mar 202320:55	–	cve
Cvelist	CVE-2023-28439 ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process	22 Mar 202320:55	–	cvelist
Debian CVE	CVE-2023-28439	22 Mar 202320:55	–	debiancve

Source	Link
ckeditor	www.ckeditor.com/cke4/addon/embed
ckeditor	www.ckeditor.com/cke4/addon/iframe
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/GWKG2VCPJNETVCDTXU4X6FQ2PO6XCNGN/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/L4ODGOW6PYVOXHQSMWJBOCE6DXWAI33W/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/VCYKD3JZWWA3ESOZG4PHJJEXT4EYIUIQ/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28439.json
github	www.github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-28439

10 Apr 2026 04:56Current

7.1High risk

Vulners AI Score7.1

CVSS 3.14.7

EPSS0.0054

ckeditor4 cross-site scripting iframe dialog media embed html editor content security policy javascript integration cve-2023-28439