CVE-2024-24816 Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

2024-02-0716:58:24

CWE-79

GitHub_M

github.com

cve-2024-24816

cross-site scripting

ckeditor4

html editor

preview feature

misconfigured

production environment

javascript code

fix available

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the preview feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.

CNA Affected

[
  {
    "vendor": "ckeditor",
    "product": "ckeditor4",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.24.0-lts"
      }
    ]
  }
]