CVE-2022-24729

 

Published at: - 16-03-2022 06:15

Last modified: - 24-10-2022 04:15

Total changes: - 5

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://ckeditor.com/cke4/release/CKEditor-4.18.0
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
• https://www.drupal.org/sa-core-2022-005
• N/A-
• FEDORA-2022-b61dfd219b-

 

Keywords

NVD

 

CVE-2022-24729

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures