CVE-2024-24816 MEDIUM

CVE-2024-24816: Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

Vendor Ckeditor
Product ckeditor4
Weakness CWE-79 · XSS
Published February 7, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.

Key dates

02Disclosure timeline

February 7, 2024 CVE published
August 1, 2024 Record updated