CVE-2024-43411 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-43411

CVSS 3.1 · Low EPSS 0,42%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Skor CVSS 3.1 3.1 (Low) menurut github.com.

Deskripsi (NVD)

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.

Rincian

Terbit di NVD: 21 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Deferred
CVSS 3.1: 3.1 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,42% peluang dieksploitasi; lebih tinggi dari 34,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.