CVE-2024-24816
Description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
How to fix
- ckeditor ckeditor4.24.0 or later
- ckeditor44.24.0-lts or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ckeditor ckeditor | 4.0 ≤ v < 4.24.0 | 4.24.0 |
| ckeditor4npm | v < 4.24.0-lts | 4.24.0-lts |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.