CVE-2022-24729

Опубликовано: 16 мар. 2022

Источник: nvd

CVSS3: 6.5

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Ссылки

https://ckeditor.com/cke4/release/CKEditor-4.18.0
Release Notes
Vendor Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
https://www.drupal.org/sa-core-2022-005
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
https://ckeditor.com/cke4/release/CKEditor-4.18.0
Release Notes
Vendor Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
https://www.drupal.org/sa-core-2022-005
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*

Версия от 4.0 (включая) до 4.18.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 9.2.15 (исключая)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 9.3.0 (включая) до 9.3.8 (исключая)

Конфигурация 3

Одно из

cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*

Версия до 22.1.1 (исключая)

cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*

Версия от 8.0.7.0.0 (включая) до 8.1.0.0.0 (включая)

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*

Версия от 8.1.1.0 (включая) до 8.1.2.1 (включая)

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.7:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

EPSS

Процентиль: 63%

0.00445

Низкий

6.5 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-400

CWE-1333

Связанные уязвимости

CVE-2022-24729

CVSS3: 6.5

ubuntu

больше 3 лет назад

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

CVE-2022-24729

CVSS3: 6.5

debian

больше 3 лет назад

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. ...

BDU:2022-07065

CVSS3: 6.5

fstec

больше 3 лет назад

Уязвимость плагина dialog WYSIWYG-редактора CKEditor, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 63%

0.00445

Низкий

6.5 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-400

CWE-1333