CVE-2022-24728

描述

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

如何修補 CVE-2022-24728

要修補 CVE-2022-24728,請將受影響套件升級到下列已修補版本。

• —升級至 9.2.15 或更新版本
• —升級至 9.2.15 或更新版本
• —未列出修補版本
• —未列出修補版本
• —升級至 9.2.15 或更新版本
• —升級至 4.18.0 或更新版本

CVE-2022-24728 正在被利用嗎?

低 — EPSS 為 1.2%,目前沒有觀察到大規模利用活動。

受影響套件(6)

• >= 8.0.0, < 9.2.15, >= 9.3.0, < 9.3.8
• >= 8.0.0, < 9.2.15, >= 9.3.0, < 9.3.8
• from 0
• from 0
• >= 8.0.0, < 9.2.15 | >= 9.3.0, < 9.3.8
• from 0, < 4.18.0

CVSS 分數

參考連結(15)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-24728
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-24728
• ADVISORYsecuritylab.github.com/advisories/GHSL-2022-009_ckeditor4
• PATCHgithub.com/ckeditor/ckeditor4
• WEB