Vulnerability · Published Aug 21, 2024 · Assigned by GitHub_M
CVE-2024-43411CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover
Low 3.1
In plain English
A low-severity cross-site scripting in ckeditor4 from ckeditor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:25.10 | ckeditor | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:22.04:LTS | ckeditor3 | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:24.04:LTS | ckeditor3 | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:22.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:24.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:25.10 | ldap-account-manager | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:26.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:22.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:24.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:25.10 | request-tracker4 | no fix listed | UBUNTU-CVE-2024-43411 |
| Ubuntu:26.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2024-43411 |
| npm | ckeditor4 | 4.25.0 | GHSA-6v96-m24v-f58j |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N