Vulnerability advisory

CVE-2023-4771

Cross-Site Scripting vulnerability in CKSource CKEditor

Published Nov 16, 2023Updated Nov 3, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/ckeditor/ckeditor4 ↗
All commits through 1aa21195bda3e4cfb4f19fa70d5a285b56965d70	No fix listed
Also listed as affected (42) `4.15.1` `4.14.1` `4.13.1` `4.12.1` `4.7.2` `4.11.4` `4.11.3` `4.11.2` `4.11.1` `4.10.1` `4.9.2` `4.9.1` `4.7.3` `4.7.1` `4.6.2` `4.6.1` `4.5.11` `4.5.10` `4.5.9` `4.5.8` `4.5.7` `4.5.6` `4.5.5` `4.5.4` `4.5.3` `4.5.2` `4.5.1` `4.5.0` `4.5.0-beta` `4.4.1` `4.4.0` `4.2.3` `4.2.2` `4.2.1` `4.2.0` `4.2` `4.1.0` `4.1` `4.1rc` `4.0.1` `4.0.0` `4.0`

Description

A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.

CVE-2023-4771

Affected versions

Repository

Description

References