CVE-2022-24729 — Uncontrolled Resource Consumption in Ckeditor4

CWE-400 — Uncontrolled Resource ConsumptionCWE-1333 — Regex Denial of Service10 documents6 sources
Severity
7.5HIGHNVD
CNA6.5OSV5.4
EPSS
0.9%
top 24.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Ckeditor Ckeditor4CkeditorDrupal+8 more
Timeline
PublishedMar 16
Latest updateApr 15

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages12 packages

▶CVEListV5ckeditor/ckeditor4< 4.18.0
▶npmckeditor/ckeditor4< 4.18.0
▶NVDckeditor/ckeditor4.0 — 4.18.0
▶Debianckeditor/ckeditor< 4.19.0+dfsg-1
▶Packagistdrupal/core8.0.0 — 9.2.15+1

Also affects: Fedora 36, 37

Patches

Patch: www.drupal.org ↗Patch: www.oracle.com ↗Patch: www.drupal.org ↗

🔴Vulnerability Details

4
OSV
CVE-2022-24728: The Drupal project uses the [CKEditor](https://github↗2022-03-16
▶
OSV
Cross-site Scripting in CKEditor4↗2022-03-16
▶
OSV
CVE-2022-24729: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor↗2022-03-16
▶
CVEList
Regular expression Denial of Service in dialog plugin↗2022-03-16
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Commerce Risk Matrix: Workbench (CKEditor) — CVE-2022-24729↗2023-04-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Analytics Server (CKEditor) — CVE-2022-24729↗2022-10-15
▶
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Application Express (CKEditor) — CVE-2022-24729↗2022-07-15
▶
Drupal
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005↗2022-03-16
▶
Debian
CVE-2022-24729: ckeditor - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 ...↗2022
▶