CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to maintain a secure environment and reduce the risk of any security incidents related to outdated or unsupported software. The fix is be available in version 4.25.0-lts.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been     discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by     exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was     included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could     craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP     web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and     updates, potential security vulnerabilities have been identified with its continued use. To mitigate these     risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi     library as a dependency. This change aims to maintain a secure environment and reduce the risk of any     security incidents related to outdated or unsupported software. The fix is be available in version     4.25.0-lts. (CVE-2024-43407)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been
    discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by
    exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was
    included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could
    craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP
    web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and
    updates, potential security vulnerabilities have been identified with its continued use. To mitigate these
    risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi
    library as a dependency. This change aims to maintain a secure environment and reduce the risk of any
    security incidents related to outdated or unsupported software. The fix is be available in version
    4.25.0-lts. (CVE-2024-43407)

According to its self-reported version number, the CKEditor application running on the remote host is prior to 4.25.0-LTS or 4.22.x prior to 4.25.0-LTS. It is, therefore, affected by multiples Cross-Site-Scripting :

- In CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. - A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
258379	Linux Distros Unpatched Vulnerability : CVE-2024-43407	Nessus	Misc.	medium
412221	SCA: security update for ckeditor/ckeditor, ckeditor4 (GHSA-7r32-vfj5-c2jv)	Tenable Cloud Security	SCA Checks	medium
412221	SCA: security update for ckeditor/ckeditor, ckeditor4 (GHSA-7r32-vfj5-c2jv)	Tenable Self-Hosted Container Security	SCA Checks	medium
114425	CKEditor < 4.25.0-LTS Multiples Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2024-43407

medium

Tenable Plugins

medium

medium

medium

medium