CVE-2024-43411

LOW EPSS 31.8%
Published Aug 21, 20241y ago · Modified Jun 17, 20261w ago
3.1 CVSS 3.1
Low
Find Similar
Published Aug 21, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.

CVSS Details

Base Score
3.1
Exploitability
0.5
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
31.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

References 2

  • github.com https://github.com/ckeditor/ckeditor4/commit/b5069c9cb769ea22eae1cbd7200f22b1cf2e3a7f
  • github.com https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6v96-m24v-f58j

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.