onyx --cves cve-2022-24728
CVE-2022-24728
- score
- <0.1
- cvss
- 5.4
- epss
- 1.2%
- published
- 2022-03-16
- kev added
- —
- first seen
CKEditor4 contains a HTML injection caused by bypassing content sanitization in core HTML processing, letting attackers inject malicious HTML and execute JavaScript, exploit requires sending crafted HTML content.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 7
- https://ckeditor.com/cke4/release/CKEditor-4.18.0
- https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89
- https://www.drupal.org/sa-core-2022-005
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/