Executive brief
CKEditor is a popular rich-text editor used in web applications to allow users to create and format content. A cross-site scripting vulnerability in CKEditor's sample page could allow an attacker to inject malicious JavaScript code that steals authorized users' sensitive information when they visit or interact with the vulnerable page.
Technical details
A cross-site scripting (XSS) vulnerability exists in CKEditor versions 4.15.1 and earlier, specifically in the /ckeditor/samples/old/ajax.html sample file. The vulnerability allows an attacker to inject and execute arbitrary JavaScript code through this sample page (CWE-79). The attack requires user interaction—a user must visit a page containing the malicious payload—but has no authentication requirements. A successful exploit enables attackers to steal session tokens, credentials, or other sensitive data from authenticated users. The vulnerability is marked as a duplicate of GHSA-wh5w-82f3-wrxh; patches are available in patched versions of CKEditor 4.
Affected products
- CKSource CKEditor 4.15.1 and earlier
Timeline
- 2023-11-16: disclosed
- 2024-02-07: other: Advisory withdrawn as duplicate of GHSA-wh5w-82f3-wrxh