Detections
Analytics

SCA: security update for ckeditor/ckeditor, ckeditor4 (GHSA-fq6h-4g8v-qqvm)

medium Tenable Cloud Security Plugin ID 414638

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability
 has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may
 affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced
 Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows
 attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could
 result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to
 prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. (CVE-2024-24815)

See Also

https://github.com/advisories/GHSA-fq6h-4g8v-qqvm

Plugin Details

Severity: Medium

ID: 414638

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2024-24815

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/7/2024

Vulnerability Publication Date: 2/7/2024

Reference Information

CVE: CVE-2024-24815

IAVA: 2024-A-0077-S

cwe: CWE-79