Log in Start free

Vulnerability · Published Mar 16, 2022 · Assigned by GitHub_M

CVE-2022-24729Regular expression Denial of Service in dialog plugin

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in ckeditor4 from ckeditor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ckeditor4.19.0+dfsg-1DEBIAN-CVE-2022-24729
Packagistdrupal/core9.2.15, 9.3.8DRUPAL-CORE-2022-005
Ubuntu:22.04:LTSckeditor3no fix listedUBUNTU-CVE-2022-24729
Ubuntu:24.04:LTSckeditor3no fix listedUBUNTU-CVE-2022-24729
Ubuntu:22.04:LTSldap-account-managerno fix listedUBUNTU-CVE-2022-24729
Ubuntu:24.04:LTSldap-account-managerno fix listedUBUNTU-CVE-2022-24729
Ubuntu:25.10ldap-account-managerno fix listedUBUNTU-CVE-2022-24729
Ubuntu:26.04:LTSldap-account-managerno fix listedUBUNTU-CVE-2022-24729
Ubuntu:22.04:LTSrequest-tracker4no fix listedUBUNTU-CVE-2022-24729
Ubuntu:24.04:LTSrequest-tracker4no fix listedUBUNTU-CVE-2022-24729
Ubuntu:25.10request-tracker4no fix listedUBUNTU-CVE-2022-24729
Ubuntu:26.04:LTSrequest-tracker4no fix listedUBUNTU-CVE-2022-24729
npmckeditor44.18.0GHSA-4fc4-4p5g-6w89

Affected products (as reported)

VendorProductVersions
ckeditor ckeditor4 < 4.18.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References