Read the docs
TI-2022-08542 Aliases CVE-2022-24728GHSA-4fc4-4p5g-6w89

Cross-site Scripting in CKEditor4

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01203 68th percentileScored 2026-11-07
Fix Fixed ckeditor4 (ckeditor): 4.18.0ckeditor4 (npm): 4.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor4before 4.18.04.18.0Patch availableCNA
—ckeditor4 (npm)before 4.18.04.18.0Patch availableGHSA-4fc4-4p5g-6w89
  • ckeditor4 Vendorckeditor Affected before 4.18.0 Fixed in 4.18.0 Patch available CNA
  • ckeditor4 (npm) Vendor— Affected before 4.18.0 Fixed in 4.18.0 Patch available GHSA-4fc4-4p5g-6w89

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*4.0 to before 4.18.0Vulnerableckeditor
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*8.0.0 to before 9.2.15; 9.3.0 to before 9.3.8VulnerableDrupal
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*before 22.1.1VulnerableOracle
cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.7.0.0 – 8.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.1:*:*:*:*:*:*:*8.1.2.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*8.1.1.0 – 8.1.2.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.0:*:*:*:*:*:*:*8.0.7.0VulnerableOracle
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions 4.0 to before 4.18.0 Vulnerable ·ckeditor
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.0.0 to before 9.2.15; 9.3.0 to before 9.3.8 Vulnerable ·Drupal
  • cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 22.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.7.0.0 – 8.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.1:*:*:*:*:*:*:* Versions 8.1.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:* Versions 8.1.1.0 – 8.1.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.0:*:*:*:*:*:*:* Versions 8.0.7.0 Vulnerable ·Oracle
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.0:*:*:*:*:*:*:*8.0.8.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.7:*:*:*:enterprise:*:*:*8.0.7VulnerableOracle
cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:enterprise:*:*:*8.0.8VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.0:*:*:*:*:*:*:* Versions 8.0.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.7:*:*:*:enterprise:*:*:* Versions 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:enterprise:*:*:* Versions 8.0.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA ckeditor4 (ckeditor) Fixed in 4.18.0
  • Fix · GHSA-4fc4-4p5g-6w89 ckeditor4 (npm) Fixed in 4.18.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24728
  2. 2026-10-03 Alias added: GHSA-4fc4-4p5g-6w89

References

Patch 3

Advisory 6

Other 3

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
  • TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
  • TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences