CVE-2022-24728: ckeditor Cross-site Scripting
Vulnerability summary
CVE-2022-24728 is a high (CVSS 7.5) Cross-site Scripting vulnerability in ckeditor. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 16-03-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected systems
Oracle6 products
- application_express< 22.1.1
- commerce_merchandising11.3.2
- financial_services_analytical_applications_infrastructure≥ 8.0.7.0.0, ≤ 8.1.0.0.0 | 8.1.1.0 | 8.1.2.0 | 8.1.2.1
- financial_services_behavior_detection_platform≥ 8.1.1.0, ≤ 8.1.2.1 | 8.0.7.0 | 8.0.8.0
- financial_services_trade-based_anti_money_laundering8.0.7 | 8.0.8
Ubuntu4 products
- ckeditorAll versions (No fix recorded)
- ckeditor3All versions (No fix recorded)
- ldap-account-managerAll versions (No fix recorded)
- request-tracker4All versions (No fix recorded)
Debian2 products
- ckeditor< 4.19.0+dfsg-1
- ckeditor3All versions (No fix recorded)
Drupal1 product
- drupal≥ 8.0.0, < 9.2.15 | ≥ 9.3.0, < 9.3.8
Fedoraproject1 product
- fedoraEOL36 | 37
Npm1 product
- ckeditor4< 4.18.0
7 vendors · 17 products
References
17 links- github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949REPORTWEBPatchThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 17 references
- github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hhThird Party Advisory