CVE-2023-28439
published 2023-03-22CVE-2023-28439: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and…
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.73%
50.0th percentile
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism.
A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ckeditor | ckeditor | >= 0 < 4.5.7+dfsg-2ubuntu0.16.04.1~esm2 | 4.5.7+dfsg-2ubuntu0.16.04.1~esm2 |
| ckeditor | ckeditor | >= 0 < 4.5.7+dfsg-2ubuntu0.18.04.1+esm1 | 4.5.7+dfsg-2ubuntu0.18.04.1+esm1 |
| ckeditor | ckeditor | >= 0 < 4.12.1+dfsg-1ubuntu0.1+esm1 | 4.12.1+dfsg-1ubuntu0.1+esm1 |
| ckeditor | ckeditor | >= 0 < 4.16.2+dfsg-1ubuntu0.1~esm1 | 4.16.2+dfsg-1ubuntu0.1~esm1 |
| ckeditor | ckeditor | >= 0 < 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 |
| ckeditor | ckeditor | >= 4.0 < 4.21.0 | 4.21.0 |
| ckeditor | ckeditor4 | < 4.21.0 | 4.21.0 |
| debian | ckeditor | — | — |
| debian | ckeditor3 | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_oracle6.1MEDIUM
vendor_ubuntu5.4MEDIUM
vendor_debian4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ckeditor vulnerabilities
osv·2025-02-06·CVSS 5.4
CVE-2022-24728 [MEDIUM] ckeditor vulnerabilities
ckeditor vulnerabilities
Kevin Backhouse discovered that CKEditor did not properly sanitize HTML
content. An attacker could possibly use this issue to perform cross site
scripting and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-24728)
It was discovered that CKEditor did not properly handle the creation of
editor instances in the Iframe Dialog and Media Embed packages. An
attacker could possibly use this issue to perform cross site scripting
and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2023-28439)
It was discovered that CKEditor did not properly handle parsing HTML
content. An attacker could possibly
OSV
CVE-2023-28439: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
osv·2023-03-22·CVSS 6.1
CVE-2023-28439 [MEDIUM] CVE-2023-28439: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin appli
Ubuntu
CKEditor vulnerabilities
vendor_ubuntu·2025-02-06·CVSS 5.4
CVE-2024-24816 [MEDIUM] CKEditor vulnerabilities
Title: CKEditor vulnerabilities
Summary: Several security issues were fixed in CKEditor.
Kevin Backhouse discovered that CKEditor did not properly sanitize HTML
content. An attacker could possibly use this issue to perform cross site
scripting and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-24728)
It was discovered that CKEditor did not properly handle the creation of
editor instances in the Iframe Dialog and Media Embed packages. An
attacker could possibly use this issue to perform cross site scripting
and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2023-28439)
It was discovered that CKEditor did not
Oracle
Oracle Oracle Siebel CRM Risk Matrix: User Interface (CKEditor) — CVE-2023-28439
vendor_oracle·2024-10-15·CVSS 6.1
CVE-2023-28439 [MEDIUM] Oracle Oracle Siebel CRM Risk Matrix: User Interface (CKEditor) — CVE-2023-28439
Oracle Oracle Siebel CRM Risk Matrix: User Interface (CKEditor) vulnerability
CVE: CVE-2023-28439
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Analytics Risk Matrix: Visual Analyzer Integration (CKEditor) — CVE-2023-28439
vendor_oracle·2024-01-15·CVSS 6.1
CVE-2023-28439 [MEDIUM] Oracle Oracle Analytics Risk Matrix: Visual Analyzer Integration (CKEditor) — CVE-2023-28439
Oracle Oracle Analytics Risk Matrix: Visual Analyzer Integration (CKEditor) vulnerability
CVE: CVE-2023-28439
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: UI (CKEditor) — CVE-2023-28439
vendor_oracle·2023-10-15·CVSS 6.1
CVE-2023-28439 [MEDIUM] Oracle Oracle Financial Services Applications Risk Matrix: UI (CKEditor) — CVE-2023-28439
Oracle Oracle Financial Services Applications Risk Matrix: UI (CKEditor) vulnerability
CVE: CVE-2023-28439
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Commerce Risk Matrix: WebUI (CKEditor) — CVE-2023-28439
vendor_oracle·2023-07-15·CVSS 6.1
CVE-2023-28439 [MEDIUM] Oracle Oracle Commerce Risk Matrix: WebUI (CKEditor) — CVE-2023-28439
Oracle Oracle Commerce Risk Matrix: WebUI (CKEditor) vulnerability
CVE: CVE-2023-28439
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Debian
CVE-2023-28439: ckeditor - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-si...
vendor_debian·2023·CVSS 4.7
CVE-2023-28439 [MEDIUM] CVE-2023-28439: ckeditor - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-si...
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin appli
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://ckeditor.com/cke4/addon/embedhttps://ckeditor.com/cke4/addon/iframehttps://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9ghttps://lists.fedoraproject.org/archives/list/[email protected]/message/GWKG2VCPJNETVCDTXU4X6FQ2PO6XCNGN/https://lists.fedoraproject.org/archives/list/[email protected]/message/L4ODGOW6PYVOXHQSMWJBOCE6DXWAI33W/https://lists.fedoraproject.org/archives/list/[email protected]/message/VCYKD3JZWWA3ESOZG4PHJJEXT4EYIUIQ/https://ckeditor.com/cke4/addon/embedhttps://ckeditor.com/cke4/addon/iframehttps://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9ghttps://lists.fedoraproject.org/archives/list/[email protected]/message/GWKG2VCPJNETVCDTXU4X6FQ2PO6XCNGN/https://lists.fedoraproject.org/archives/list/[email protected]/message/L4ODGOW6PYVOXHQSMWJBOCE6DXWAI33W/https://lists.fedoraproject.org/archives/list/[email protected]/message/VCYKD3JZWWA3ESOZG4PHJJEXT4EYIUIQ/
2023-03-22
Published