CVE-2024-45613
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-45613
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45613.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-45613
- Aliases
- Downstream
- Published
- 2024-09-25T13:27:03.546Z
- Modified
- 2025-12-05T06:17:51.701035Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package
- Details
-
CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45613.json" }- References