CVE-2022-24728 (Medium) detected in ckeditor-4.14.1.js

[mend-bolt-for-github]

CVE-2022-24728 - Medium Severity Vulnerability

Vulnerable Library - ckeditor-4.14.1.js

The development version of CKEditor - JavaScript WYSIWYG web text editor.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/ckeditor/4.14.1/ckeditor.js

Path to dependency file: /static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/image2/image2.html

Path to vulnerable library: /static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/image2/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/image2/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/emoji/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/emoji/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/divarea/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/enterkey/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/placeholder/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/uicolor/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/sharedspace/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/enterkey/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/bbcode/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/sourcedialog/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/toolbar/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/magicline/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/autogrow/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/bbcode/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/easyimage/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/htmlwriter/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/wysiwygarea/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/codesnippet/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/tableresize/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/wysiwygarea/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/devtools/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/tableresize/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/uicolor/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/devtools/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/placeholder/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/docprops/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/dialog/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/divarea/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/dialog/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/htmlwriter/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/toolbarconfigurator/../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/stylesheetparser/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/toolbar/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/stylesheetparser/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/mathjax/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/autogrow/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/easyimage/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/mentions/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/old/codesnippet/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/youtube/bower_components/ckeditor/samples/toolbarconfigurator/../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/sharedspace/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/sourcedialog/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/magicline/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/mentions/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/mathjax/../../../ckeditor.js,/static/ckeditor/ckeditor/plugins/btgrid/bower_components/ckeditor/samples/old/docprops/../../../ckeditor.js

Dependency Hierarchy:

• ❌ ckeditor-4.14.1.js (Vulnerable Library)

Found in base branch: master

Vulnerability Details

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Publish Date: 2022-03-16

URL: CVE-2022-24728

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4fc4-4p5g-6w89

Release Date: 2022-03-16

Fix Resolution: ckeditor4 - 4.18.0

---

Step up your Open Source Security Game with Mend here