Is CVE-2024-43407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-43407 being exploited in the wild.

How severe is CVE-2024-43407?

Low severity, with a CVSS score of 3.1, published 21 August 2024.

Which products and versions are affected?

ckeditor4 (npm) SEMVER:introduced=0,fixed=4.25.0; ckeditor/ckeditor (Packagist) ECOSYSTEM:introduced=0,fixed=4.25.0.

Is there a fix for CVE-2024-43407?

Yes. ckeditor4 (npm): upgrade to 4.25.0 or later; ckeditor/ckeditor (Packagist): upgrade to 4.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-43407 attacked?

It is attacked over the network.

Am I affected by CVE-2024-43407?

Check whether you run ckeditor4 (npm) or ckeditor/ckeditor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-43407: CKEditor 4 Code Snippet GeSHi plugin reflected XSS

CVE-2024-43407 · Severity: low · CVSS 3.1 · Published 2024-08-21

CKEditor 4 is a widely-used rich text editor embedded in web applications to allow users to create and format content. A reflected cross-site scripting vulnerability in the bundled GeSHi syntax highlighter plugin allows attackers to inject malicious scripts that execute in a victim's browser when they visit a crafted URL, potentially compromising user sessions or stealing sensitive data.

Technologies: ckeditor4 (npm), ckeditor/ckeditor (Packagist). Vendors: npm, Packagist.

Quick answers

Is CVE-2024-43407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-43407 being exploited in the wild.
How severe is CVE-2024-43407?: Low severity, with a CVSS score of 3.1, published 21 August 2024.
Which products and versions are affected?: ckeditor4 (npm) SEMVER:introduced=0,fixed=4.25.0; ckeditor/ckeditor (Packagist) ECOSYSTEM:introduced=0,fixed=4.25.0.
Is there a fix for CVE-2024-43407?: Yes. ckeditor4 (npm): upgrade to 4.25.0 or later; ckeditor/ckeditor (Packagist): upgrade to 4.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-43407 attacked?: It is attacked over the network.
Am I affected by CVE-2024-43407?: Check whether you run ckeditor4 (npm) or ckeditor/ckeditor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ckeditor4 (npm): upgrade to 4.25.0 or later
```
npm install ckeditor4@4.25.0
```
ckeditor/ckeditor (Packagist): upgrade to 4.25.0 or later
```
composer require ckeditor/ckeditor:^4.25.0
```

Technical details

A reflected XSS vulnerability exists in the Code Snippet GeSHi plugin included with CKEditor 4, stemming from improper handling of input in the GeSHi syntax highlighter library (an unmaintained third-party dependency). An attacker can craft a malicious request to the GeSHi library hosted on a PHP web server to execute arbitrary JavaScript in the victim's browser. The attack requires user interaction (victim clicking a malicious link), but no authentication is needed. The vulnerability affects all CKEditor 4 versions prior to 4.25.0-lts, in which the GeSHi library has been removed entirely. Integrators wishing to continue using GeSHi are advised to source it independently and review its security posture.

Affected products

CKSource CKEditor 4 before 4.25.0-lts

Identifiers

CVE-2024-43407
GHSA-7r32-vfj5-c2jv

Timeline

2024-08-21: disclosed
2024-08-21: patched: Fixed in version 4.25.0-lts

References

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7r32-vfj5-c2jv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.