Is CVE-2024-43411 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-43411 being exploited in the wild.

How severe is CVE-2024-43411?

Low severity, with a CVSS score of 3.1, published 21 August 2024.

Which products and versions are affected?

ckeditor4 (npm) SEMVER:introduced=4.22.0,fixed=4.25.0.

Is there a fix for CVE-2024-43411?

Yes. ckeditor4 (npm): upgrade to 4.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-43411 attacked?

It is attacked over the network.

Am I affected by CVE-2024-43411?

Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-43411: CKEditor4 cross-site scripting via domain takeover

CVE-2024-43411 · Severity: low · CVSS 3.1 · Published 2024-08-21

CKEditor4 is a popular rich-text editing component used in web applications. A theoretical cross-site scripting (XSS) vulnerability exists only if an attacker gains control of the ckeditor.com domain and the target instance has version notifications enabled (disabled by default). The risk is low because the domain takeover itself is an extremely unlikely prerequisite, and the feature is off by default in supported versions.

Technologies: ckeditor4 (npm). Vendors: npm.

Quick answers

Is CVE-2024-43411 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-43411 being exploited in the wild.
How severe is CVE-2024-43411?: Low severity, with a CVSS score of 3.1, published 21 August 2024.
Which products and versions are affected?: ckeditor4 (npm) SEMVER:introduced=4.22.0,fixed=4.25.0.
Is there a fix for CVE-2024-43411?: Yes. ckeditor4 (npm): upgrade to 4.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-43411 attacked?: It is attacked over the network.
Am I affected by CVE-2024-43411?: Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ckeditor4 (npm): upgrade to 4.25.0 or later
```
npm install ckeditor4@4.25.0
```

Technical details

CKEditor4 versions 4.22.0 and above contain an XSS vulnerability (CWE-79) that is contingent on external domain compromise. The vulnerability is only reachable if version notifications are explicitly enabled on the editor instance and an attacker successfully takes control of the https://cke4.ckeditor.com domain. Since version notifications are disabled by default in CKEditor 4 LTS releases, the exposure is minimal in practice. The vulnerability has been patched in version 4.25.0-lts. No active exploitation in the wild has been reported.

Affected products

CKSource CKEditor4 4.22.0 to 4.25.0-lts

Identifiers

CVE-2024-43411
GHSA-6v96-m24v-f58j

Timeline

2024-08-21: disclosed
2024-08-21: patched: Fix available in CKEditor4 4.25.0-lts

References

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6v96-m24v-f58j

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.