CVE details
CVE-2024-24816
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| www/ckeditor | ckeditor | 4.21.0 | unaddressed | sunpoet@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>ckeditor</name>
<range><lt>4.24.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.
A cross-site scripting vulnerability vulnerability has been discovered
in versions prior to 4.24.0-lts in samples that use the `preview`
feature. All integrators that use these samples in the production code
can be affected. The vulnerability allows an attacker to execute
JavaScript code by abusing the misconfigured preview feature. It
affects all users using the CKEditor 4 at version < 4.24.0-lts with
affected samples used in a production environment. A fix is available
in version 4.24.0-lts.</p>
</body>
</description>
<references>
<cvename>CVE-2024-24816</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-24816</url>
</references>
<dates>
<discovery>2024-02-07</discovery>
<entry>2026-10-26</entry>
</dates>
</vuln>