CVE-2024-43407

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>ckeditor</name>
	<range><lt>4.25.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.
	A potential vulnerability has been discovered in CKEditor 4 Code
	Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack
	by exploiting a flaw in the GeSHi syntax highlighter library hosted by
	the victim. The GeSHi library was included as a vendor dependency in
	CKEditor 4 source files. In a specific scenario, an attacker could
	craft a malicious script that could be executed by sending a request
	to the GeSHi library hosted on a PHP web server. The GeSHi library is
	no longer actively maintained. Due to the lack of ongoing support and
	updates, potential security vulnerabilities have been identified with
	its continued use. To mitigate these risks and enhance the overall
	security of the CKEditor 4, we have decided to completely remove the
	GeSHi library as a dependency. This change aims to maintain a secure
	environment and reduce the risk of any security incidents related to
	outdated or unsupported software. The fix is be available in version
	4.25.0-lts.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-43407</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-43407</url>
    </references>
    <dates>
      <discovery>2024-08-21</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>