CVE-2022-24728 Cross-site Scripting in CKEditor4

What is CVE-2022-24728?

CVE-2022-24728 is a medium-severity vulnerability in Drupal Drupal, published on 16 Mar 2022.

Official description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Weakness: CWE-79

Which versions are affected by CVE-2022-24728?

It affects 9 products.

Products include Ckeditor Ckeditor, Drupal Drupal, Fedoraproject Fedora, Oracle Application Express, Oracle Commerce Merchandising, Oracle Financial Services Analytical Applications Infrastructure and 3 more.

How do I fix CVE-2022-24728?

Upgrade to a fixed version.

Is CVE-2022-24728 being exploited?

There is no known exploitation of CVE-2022-24728 in the wild and no public exploit code.

Other vulnerabilities in Drupal Drupal

• CVE-2023-31541 File upload in n/a Critical 9.8
• CVE-2021-41164 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML High 8.2
• CVE-2021-41165 HTML comments vulnerability allowing to execute JavaScript code High 8.2
• CVE-2021-32808 Cross-site scripting in ckeditor via abuse of undo functionality High 7.6
• CVE-2011-4972 Missing authorization in CKEditor Drupal module High 7.5

All Drupal Drupal vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as DEBIAN-CVE-2022-24728, UBUNTU-CVE-2022-24728.