CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been     identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control     over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4     instances. The issue impacts only editor instances with enabled version notifications. Please note that     this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS,     it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us.
    The fix is available in version 4.25.0-lts. (CVE-2024-43411)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7258-1 advisory.

    Kevin Backhouse discovered that CKEditor did not properly sanitize HTML content. An attacker could     possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24728)

    It was discovered that CKEditor did not properly handle the creation of editor instances in the Iframe     Dialog and Media Embed packages. An attacker could possibly use this issue to perform cross site scripting     and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28439)

    It was discovered that CKEditor did not properly handle parsing HTML content. An attacker could possibly     use this issue to perform cross site scripting and obtain sensitive information. (CVE-2024-24815,     CVE-2024-24816)

    It was discovered that CKEditor did not properly sanitize version notifications. An attacker could     possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only     affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been
    identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control
    over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4
    instances. The issue impacts only editor instances with enabled version notifications. Please note that
    this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS,
    it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us.
    The fix is available in version 4.25.0-lts. (CVE-2024-43411)

According to its self-reported version number, the CKEditor application running on the remote host is prior to 4.25.0-LTS or 4.22.x prior to 4.25.0-LTS. It is, therefore, affected by multiples Cross-Site-Scripting :

- In CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. - A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257025	Linux Distros Unpatched Vulnerability : CVE-2024-43411	Nessus	Misc.	low
215049	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : CKEditor vulnerabilities (USN-7258-1)	Nessus	Ubuntu Local Security Checks	medium
411630	SCA: security update for ckeditor4 (GHSA-6v96-m24v-f58j)	Tenable Cloud Security	SCA Checks	medium
411630	SCA: security update for ckeditor4 (GHSA-6v96-m24v-f58j)	Tenable Self-Hosted Container Security	SCA Checks	medium
114425	CKEditor < 4.25.0-LTS Multiples Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2024-43411

medium

Tenable Plugins

low

medium

medium

medium

medium