{"id":"GHSA-6v96-m24v-f58j","summary":"CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover","details":"### Affected Packages\n\nThe issue impacts only editor instances with enabled [version notifications](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-versionCheck).\n\nPlease note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please [contact us](mailto:security@cksource.com).\n\n### Impact\n\nA theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, we have addressed it in CKEditor 4.25.0-lts to ensure compliance with security best practices.\n\n### Patches\n\nThe issue has been recognized and patched. The fix is available in version 4.25.0-lts.\n\n### For More Information\n\nIf you have any questions or comments about this advisory, please email us at [security@cksource.com](mailto:security@cksource.com).","aliases":["CVE-2024-43411"],"modified":"2024-11-18T16:27:06Z","published":"2024-08-21T18:31:00Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-08-21T18:31:00Z","nvd_published_at":"2024-08-21T16:15:08Z","cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6v96-m24v-f58j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43411"},{"type":"WEB","url":"https://github.com/ckeditor/ckeditor4/commit/b5069c9cb769ea22eae1cbd7200f22b1cf2e3a7f"},{"type":"PACKAGE","url":"https://github.com/ckeditor/ckeditor4"}],"affected":[{"package":{"name":"ckeditor4","ecosystem":"npm","purl":"pkg:npm/ckeditor4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.22.0"},{"fixed":"4.25.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-6v96-m24v-f58j/GHSA-6v96-m24v-f58j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}