CVE-2024-43411 CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover
An attacker controlling the CKEditor domain could inject scripts into editors with version notifications enabled, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-43411?
CVE-2024-43411 is a low-severity cross-site scripting vulnerability in ckeditor4, published on 21 Aug 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.
Weakness: CWE-79
Which versions are affected by CVE-2024-43411?
2 open source packages ship an affected version, including ckeditor4.
| Package | Affected | Fixed in |
|---|---|---|
ckeditor4 npm | From 4.22.0 | 4.25.0 |
ckeditor4 npm | From 4.22.0 | 4.25.0 |
How do I fix CVE-2024-43411?
Upgrade ckeditor4 to 4.25.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-43411 being exploited?
There is no known exploitation of CVE-2024-43411 in the wild and no public exploit code.
Sources
Also known as GHSA-6v96-m24v-f58j, UBUNTU-CVE-2024-43411.