CVE-2023-28439
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-28439
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-28439.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-28439
- Related
- Published
- 2023-03-22T21:15:18Z
- Modified
- 2025-01-08T09:29:15.426157Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than
<textarea>as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism.A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the
sandboxattribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure theconfig.iframe_attributesoption. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure theconfig.embed_keepOriginalContentoption. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page. - References
-
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWKG2VCPJNETVCDTXU4X6FQ2PO6XCNGN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L4ODGOW6PYVOXHQSMWJBOCE6DXWAI33W/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCYKD3JZWWA3ESOZG4PHJJEXT4EYIUIQ/
- https://ckeditor.com/cke4/addon/embed
- https://ckeditor.com/cke4/addon/iframe
- https://security-tracker.debian.org/tracker/CVE-2023-28439
Affected packages
Debian:11 / ckeditor
Package
- Name
- ckeditor
- Purl
- pkg:deb/debian/ckeditor?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:12 / ckeditor
Package
- Name
- ckeditor
- Purl
- pkg:deb/debian/ckeditor?arch=source
Debian:13 / ckeditor
Package
- Name
- ckeditor
- Purl
- pkg:deb/debian/ckeditor?arch=source
Debian:11 / ckeditor3
Package
- Name
- ckeditor3
- Purl
- pkg:deb/debian/ckeditor3?arch=source
Debian:12 / ckeditor3
Package
- Name
- ckeditor3
- Purl
- pkg:deb/debian/ckeditor3?arch=source
Debian:13 / ckeditor3
Package
- Name
- ckeditor3
- Purl
- pkg:deb/debian/ckeditor3?arch=source
Git / github.com/ckeditor/ckeditor-releases
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ckeditor/ckeditor-releases
- Events
- Type
- GIT
- Repo
- https://github.com/ckeditor/ckeditor4
- Events