CVE-2024-24816
Published: 07 February 2024
Summary
CVE-2024-24816 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Ckeditor Ckeditor. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CKEditor4 is an open source WYSIWYG HTML editor that contains a cross-site scripting vulnerability in versions prior to 4.24.0-lts. The flaw exists in the preview samples and stems from CWE-79 improper neutralization of input during web page generation, allowing script execution when the misconfigured preview feature processes attacker-controlled content. It impacts any integrator that incorporates the affected samples into production deployments.
An unauthenticated remote attacker can exploit the issue over the network by supplying crafted input that triggers JavaScript execution in a victim's browser when the preview feature is invoked. The attack requires user interaction and yields limited confidentiality and integrity impact with changed scope, as reflected in the CVSS 6.1 rating.
The official GitHub Security Advisory and accompanying patches state that the vulnerability is resolved in CKEditor4 4.24.0-lts; integrators are advised to update to this release and remove or isolate any preview samples from production environments. The EPSS score has remained flat at 0.3983 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0677
Vulnerability details
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be…
more
affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.