npm/ckeditor4 CVE-2022-24728, CVE-2022-24729: medium 5.4, EPSS 1.20%
Cross-site Scripting in CKEditor4
Action: Upgrade ckeditor4 to 4.18.0 or later.
npm i ckeditor4@4.18.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.18.0 | - |
Fixed versions
| 4.18.0 |
Sources
- osv: GHSA-4fc4-4p5g-6w89
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89
- https://nvd.nist.gov/vuln/detail/CVE-2022-24728
- https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949
- https://ckeditor.com/cke4/release/CKEditor-4.18.0
- https://github.com/ckeditor/ckeditor4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP
- https://securitylab.github.com/advisories/GHSL-2022-009_ckeditor4
- https://www.drupal.org/sa-core-2022-005
- https://www.oracle.com/security-alerts/cpujul2022.html
CVE-2022-24728, CVE-2022-24729 · published · modified · JSON