CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.

According to its self-reported version number, the CKEditor application running on the remote host is 5.40.x prior to 5.41.3.2 or 5.43.1.x prior to 5.43.1.1. It is, therefore, affected by a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a     Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This     vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code     execution, if the attacker managed to insert a malicious content into the editor, which might happen with     a very specific editor configuration. This vulnerability only affects installations where the Block     Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe     markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As     a workaround, one may disable the block toolbar plugin. (CVE-2024-45613)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a
    Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This
    vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code
    execution, if the attacker managed to insert a malicious content into the editor, which might happen with
    a very specific editor configuration. This vulnerability only affects installations where the Block
    Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe
    markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As
    a workaround, one may disable the block toolbar plugin. (CVE-2024-45613)

ID	Name	Product	Family	Severity
115164	CKEditor < 43.1.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
115163	CKEditor 5.40.0.x < 5.41.3.2 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
250565	Linux Distros Unpatched Vulnerability : CVE-2024-45613	Nessus	Misc.	medium
418723	SCA: security update for @ckeditor/ckeditor5-clipboard, ckeditor5 (GHSA-rgg8-g5x8-wr9v)	Tenable Cloud Security	SCA Checks	medium
418723	SCA: security update for @ckeditor/ckeditor5-clipboard, ckeditor5 (GHSA-rgg8-g5x8-wr9v)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2024-45613

medium

Tenable Plugins

medium

medium

medium

medium

medium