Vulnerability in CKEditor4 Package
Summary
CVE-2024-43411: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. Affects ckeditor versions < b5069c9cb769ea22eae1cbd7200f22b1cf2e3a7f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CKEditor4 is an open-source what-you-see-is-what-you-get HTML editor. It provides a user-friendly interface for creating and editing HTML content. The package is widely used in web applications to enable rich text editing capabilities. However, a vulnerability has been discovered in CKEditor 4.22 and above versions.
Vulnerability Detail
The vulnerability, identified as CVE-2024-43411, exists in CKEditor 4 instances with enabled version notifications. In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. It is important to note that this vulnerability only affects editor instances with enabled version notifications. By default, this feature is disabled in all CKEditor 4 LTS versions. Therefore, if you are using CKEditor 4 LTS, the likelihood of being affected by this vulnerability is minimal. However, if you are unsure, it is recommended to contact the CKEditor support team. The vulnerability has been addressed in version 4.25.0-lts of CKEditor.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, ensuring that version notifications are disabled in your CKEditor 4 instances can help mitigate the risk. Additionally, regularly updating your CKEditor package to the latest LTS version is a good practice to stay protected against potential vulnerabilities.
Conclusion
CKEditor4, an open-source HTML editor, has been found to have a vulnerability in versions 4.22 and above. This vulnerability can be exploited if an attacker gains control over the https://cke4.ckeditor.com domain. However, the impact of this vulnerability is minimal as it only affects instances with enabled version notifications. CKEditor 4 LTS versions are not affected by default. To mitigate the risk, it is recommended to update to version 4.25.0-lts or above and disable version notifications.
See every vulnerability recorded for ckeditor →
FAQ
The vulnerability affects CKEditor 4.22 and above versions.
No, the vulnerability is not present in CKEditor 4 LTS versions by default. The version notifications feature, which is required for the vulnerability to be exploited, is disabled in CKEditor 4 LTS.
You can use Vulert's playground (https://vulert.com/scanner) to check if your CKEditor package is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, allowing you to assess the security status of your software without requiring access to the code or installation.
If you are using a version of CKEditor that is affected by this vulnerability, it is recommended to update your package to version 4.25.0-lts or above. This update includes the necessary security patches to address the vulnerability.
No known exploits of this vulnerability have been reported at the time of this advisory. However, it is crucial to update your CKEditor package to the latest version to ensure you are protected against potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
