Vulnerability · Published Mar 16, 2022 · Assigned by GitHub_M
CVE-2022-24729Regular expression Denial of Service in dialog plugin
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in ckeditor4 from ckeditor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ckeditor | 4.19.0+dfsg-1 | DEBIAN-CVE-2022-24729 |
| Packagist | drupal/core | 9.2.15, 9.3.8 | DRUPAL-CORE-2022-005 |
| Ubuntu:22.04:LTS | ckeditor3 | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:24.04:LTS | ckeditor3 | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:22.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:24.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:25.10 | ldap-account-manager | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:26.04:LTS | ldap-account-manager | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:22.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:24.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:25.10 | request-tracker4 | no fix listed | UBUNTU-CVE-2022-24729 |
| Ubuntu:26.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2022-24729 |
| npm | ckeditor4 | 4.18.0 | GHSA-4fc4-4p5g-6w89 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H