Is CVE-2023-4771 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-4771 being exploited in the wild.

How severe is CVE-2023-4771?

Low severity, with a CVSS score of 3.1, published 7 February 2024.

Which products and versions are affected?

ckeditor4 (npm) SEMVER:introduced=0,fixed=4.24.0-lts.

Is there a fix for CVE-2023-4771?

Yes. ckeditor4 (npm): upgrade to 4.24.0-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-4771 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-4771?

Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-4771: CKEditor cross-site scripting in AJAX sample

CVE-2023-4771 · Severity: low · CVSS 3.1 · Published 2024-02-07

CKEditor is a widely-used rich text editor component embedded in web applications. A cross-site scripting (XSS) vulnerability exists in the AJAX sample file shipped with CKEditor 4, allowing an attacker to inject and execute malicious JavaScript code in users' browsers. Organizations that have deployed this sample code in production environments could be compromised.

Technologies: ckeditor4 (npm). Vendors: npm.

Quick answers

Is CVE-2023-4771 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-4771 being exploited in the wild.
How severe is CVE-2023-4771?: Low severity, with a CVSS score of 3.1, published 7 February 2024.
Which products and versions are affected?: ckeditor4 (npm) SEMVER:introduced=0,fixed=4.24.0-lts.
Is there a fix for CVE-2023-4771?: Yes. ckeditor4 (npm): upgrade to 4.24.0-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-4771 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-4771?: Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ckeditor4 (npm): upgrade to 4.24.0-lts or later
```
npm install ckeditor4@4.24.0-lts
```

Technical details

This is a cross-site scripting (CWE-79) vulnerability in the samples/old/ajax.html sample file shipped with CKEditor 4. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code via the AJAX sample when it is used in a production environment. The attack requires user interaction (the user must interact with the affected sample). The vulnerability affects all versions of CKEditor 4 prior to 4.24.0-lts. A fix was released in version 4.24.0-lts.

Affected products

CKSource CKEditor 4 < 4.24.0-lts

Identifiers

CVE-2023-4771
GHSA-wh5w-82f3-wrxh

Timeline

2024-02-07: disclosed
2024-02-07: patched: Fix available in version 4.24.0-lts

References

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-wh5w-82f3-wrxh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.