CVE-2022-24728

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24728
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24728.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24728
Aliases
Downstream
Published
2022-03-16T00:00:00Z
Modified
2026-03-15T14:47:01.089620Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-site Scripting in CKEditor4
Details

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24728.json"
}
References

Affected packages

Git / github.com/ckeditor/ckeditor4

Affected ranges

Type
GIT
Repo
https://github.com/ckeditor/ckeditor4
Events
Introduced
769d96134bcf29f5d3d870e25797ce9b9dc8289e
Fixed
5fe059002f8c207df80b44ef999f3d1eec280694

Affected versions

4.*
4.0
4.0.0
4.0.1
4.0.1.1
4.0.2
4.0.3
4.1
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.1
4.11.0
4.11.1
4.11.2
4.11.3
4.11.4
4.12.0
4.12.1
4.13.0
4.13.1
4.14.0
4.14.1
4.15.0
4.15.1
4.16.0
4.16.1
4.16.2
4.17.0
4.17.1
4.17.2
4.1rc
4.2
4.2.0
4.2.1
4.2.2
4.2.3
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3beta
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.5.0
4.5.0-beta
4.5.1
4.5.10
4.5.11
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.9.0
4.9.1
4.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24728.json"

Git / github.com/drupal/drupal

Affected ranges

Type
GIT
Repo
https://github.com/drupal/drupal
Events
Introduced
35c2f3ca5c935f3d8bde15932a712677c9bbd50f
Fixed
b68374146298b7277939e9c3208ab0518ff78d1a
Introduced
698ee686c23de8c97d7e0601cf745b220d54f4e1
Fixed
aabeae28aa10e9a22ca903d140704846c1df161a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0266059ef71465105aeb687e2d4124f0da46fe9c
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "9.2.15"
        },
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.3.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "11.3.2"
        }
    ]
}

Affected versions

10.*
10.0.0-alpha1
10.0.0-alpha3
10.0.0-alpha4
10.0.0-alpha5
10.1.0-alpha1
11.*
11.0.0-alpha1
11.2.0-rc1
11.3.0
11.3.0-alpha1
11.3.0-beta1
11.3.0-rc1
11.3.0-rc2
11.3.1
11.3.2
8.*
8.0.0
8.1.0-beta1
9.*
9.0.0-alpha1
9.0.0-alpha2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24728.json"