CVE-2022-24729

Katalog CVE

CVSS 7.5 · High EPSS 2,5%

Kerentanan Uncontrolled Resource Consumption pada ckeditor, drupal +7 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Rincian

Terbit di NVD

16 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ckeditor.com/cke4/release/CKEditor-4.18.0 release notes · advisory vendor
• https://www.drupal.org/sa-core-2022-005 patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QU...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKK...