CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
References
| Link | Resource |
|---|---|
| https://ckeditor.com/cke4/release/CKEditor-4.18.0 | Release Notes Vendor Advisory |
| https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh | Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/ | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ | |
| https://www.drupal.org/sa-core-2022-005 | Patch Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
30 Jun 2023, 18:58
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1333 | |
| CPE | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | |
| References |
|
07 Nov 2022, 17:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.7:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* |
|
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - Mailing List, Third Party Advisory | |
| References | (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory |
24 Oct 2022, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jul 2022, 18:21
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE | CWE-400 |
28 Mar 2022, 13:11
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| References | (CONFIRM) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh - Third Party Advisory | |
| References | (MISC) https://ckeditor.com/cke4/release/CKEditor-4.18.0 - Release Notes, Vendor Advisory | |
| References | (CONFIRM) https://www.drupal.org/sa-core-2022-005 - Patch, Third Party Advisory | |
| CWE | NVD-CWE-Other | |
| CPE | cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* |
16 Mar 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Mar 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-16 17:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-24729
Mitre link : CVE-2022-24729
CVE.ORG link : CVE-2022-24729
JSON object : View
Products Affected
oracle
- peoplesoft_enterprise_peopletools
- financial_services_analytical_applications_infrastructure
- financial_services_behavior_detection_platform
- commerce_merchandising
- application_express
- financial_services_trade-based_anti_money_laundering
ckeditor
- ckeditor
drupal
- drupal
fedoraproject
- fedora