Vulnerability advisory

CVE-2024-43407

Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

Published Aug 21, 2024Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/ckeditor/ckeditor4 ↗
769d96134bcf29f5d3d870e25797ce9b9dc8289e to before 82796d03d0ebbe34d48f3b65c6dde27107812a51	`82796d03d0ebbe34d48f3b65c6dde27107812a51`
Not specified	`71072c9f7f263329841bd38e7e5309074c82ef94`
Not specified	`951e7d75fcbcaa2590b0719fb0bb0dd0539ca6fa`
GIT github.com/ckeditor/ckeditor4-releases ↗
870a561110a23435d78eda377400dca7f64d3bd3 to before e84b29d3b3e7e211f0acc686d55586f63579c363	`e84b29d3b3e7e211f0acc686d55586f63579c363`
Also listed as affected (119) `4.24.0-lts` `4.23.0-lts` `4.22.1` `4.22.0` `4.21.0` `4.20.2` `4.20.1` `4.20.0` `4.19.1` `4.19.0` `4.18.0` `4.17.2` `4.17.1` `4.17.0` `4.16.0` `4.15.0` `4.14.0` `4.13.0` `4.12.0` `4.10.0` `4.8.0` `4.7.0` `4.6.0` `4.5.0` `4.5.0-beta` `4.4.1` `4.4.0` `4.2.3` `4.2.2` `4.2.1` `4.2.0` `4.2` `4.1.0` `4.1` `4.1rc` `4.0.1` `4.0.0` `4.0` `standard/4.24.0-lts` `standard/4.23.0-lts` `standard/4.22.1` `standard/4.22.0` `standard/4.21.0` `standard/4.20.2` `standard/4.20.1` `standard/4.20.0` `standard/4.19.1` `standard/4.19.0` `standard/4.18.0` `standard/4.17.2` `standard/4.17.1` `standard/4.17.0` `standard/4.16.2` `standard/4.16.1` `standard/4.16.0` `standard/4.15.1` `standard/4.15.0` `standard/4.14.1` `standard/4.14.0` `standard/4.13.1` `standard/4.13.0` `standard/4.12.1` `standard/4.12.0` `standard/4.11.4` `standard/4.11.3` `standard/4.11.2` `standard/4.11.1` `standard/4.11.0` `standard/4.10.1` `standard/4.10.0` `standard/4.9.2` `standard/4.9.1` `standard/4.9.0` `standard/4.8.0` `standard/4.7.3` `standard/4.7.2` `standard/4.7.1` `standard/4.7.0` `standard/4.6.2` `standard/4.6.1` `standard/4.6.0` `standard/4.5.11` `standard/4.5.10` `standard/4.5.9` `standard/4.5.8` `standard/4.5.7` `standard/4.5.6` `standard/4.5.5` `standard/4.5.4` `standard/4.5.3` `standard/4.5.2` `standard/4.5.1` `standard/4.5.0` `standard/4.4.8` `standard/4.4.7` `standard/4.4.6` `standard/4.4.5` `standard/4.4.4` `standard/4.4.3` `standard/4.4.2` `standard/4.4.1` `standard/4.4.0` `standard/4.3.5` `standard/4.3.4` `standard/4.3.3` `4.3.2/standard` `4.3.1/standard` `4.3.0/standard` `4.2.3/standard` `4.2.2/standard` `4.2.1/standard` `4.2/standard` `4.1.3/standard` `4.1.2/standard` `4.1.1/standard` `4.1/standard` `4.1rc/standard` `4.0.1/standard` `4.0/standard`

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to maintain a secure environment and reduce the risk of any security incidents related to outdated or unsupported software. The fix is be available in version 4.25.0-lts.

CVE-2024-43407

Affected versions

Repository

Description

References