A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and     earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file     and retrieve an authorized user's information. (CVE-2023-4771)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and
    earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file
    and retrieve an authorized user's information. (CVE-2023-4771)

According to its self-reported version number, the CKEditor application running on the remote host is prior to 4.24.0-LTS. It is, therefore, affected by multiples Cross-Site-Scripting :

- In samples that are shipped with production code. The vulnerability allowed to execute JavaScript code by abusing the misconfigured preview feature. - In samples that are shipped with production code. The vulnerability allowed to execute JavaScript code by abusing the AJAX sample. - Through processing core module. The vulnerability allowed to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
257369	Linux Distros Unpatched Vulnerability : CVE-2023-4771	Nessus	Misc.	Local	medium
419933	SCA: security update for ckeditor4 (GHSA-wh5w-82f3-wrxh)	Tenable Cloud Security	SCA Checks	Local	medium
419933	SCA: security update for ckeditor4 (GHSA-wh5w-82f3-wrxh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
114426	CKEditor < 4.24.0-LTS Multiples Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2023-4771

medium

Tenable Plugins

medium

medium

medium

medium