Executive brief
CKEditor is a widely-used rich text editor component embedded in web applications. A cross-site scripting (XSS) vulnerability exists in the AJAX sample file shipped with CKEditor 4, allowing an attacker to inject and execute malicious JavaScript code in users' browsers. Organizations that have deployed this sample code in production environments could be compromised.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in the samples/old/ajax.html sample file shipped with CKEditor 4. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code via the AJAX sample when it is used in a production environment. The attack requires user interaction (the user must interact with the affected sample). The vulnerability affects all versions of CKEditor 4 prior to 4.24.0-lts. A fix was released in version 4.24.0-lts.
Affected products
- CKSource CKEditor 4 < 4.24.0-lts
Timeline
- 2024-02-07: disclosed
- 2024-02-07: patched: Fix available in version 4.24.0-lts