CVE-2022-24728

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

How to fix CVE-2022-24728

To remediate CVE-2022-24728, upgrade the affected package to a fixed version below.

• —upgrade to 9.2.15 or later
• —upgrade to 9.2.15 or later
• —no fix listed
• —no fix listed
• —upgrade to 9.2.15 or later
• —upgrade to 4.18.0 or later

Is CVE-2022-24728 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• >= 8.0.0, < 9.2.15, >= 9.3.0, < 9.3.8
• >= 8.0.0, < 9.2.15, >= 9.3.0, < 9.3.8
• from 0
• from 0
• >= 8.0.0, < 9.2.15 | >= 9.3.0, < 9.3.8
• from 0, < 4.18.0

CVSS scores

References (15)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-24728
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-24728
• ADVISORYsecuritylab.github.com/advisories/GHSL-2022-009_ckeditor4
• PATCHgithub.com/ckeditor/ckeditor4
• WEB