VDB
BDU%3A2023-05267
BDU%3A2023-05267
PUBLISHED
CVSS 4.699999809265137 MEDIUM
Уязвимость пакетов Iframe Dialog и Media Embed WYSIWYG-редактора CKEditor, позволяющая нарушителю выполнить произвольный JavaScript-код
Risk Scores
CVSS 3.1
4.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ckeditor | ckeditor4 | < 4.21.0 |
| The CKEditor Team | CKEditor |
Timeline
- Mar 22, 2023 CVE Published
- Mar 22, 2023 PoC Published
- Sep 7, 2023 CVE Updated
- Feb 9, 2024 PoC Published
References
- https://www.oracle.com/security-alerts/cpujul2023.html url
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g url
- https://nvd.nist.gov/vuln/detail/CVE-2023-28439 url
- https://ckeditor.com/cke4/addon/embed url
- https://ckeditor.com/cke4/addon/iframe url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L4ODGOW6PYVOXHQSMWJBOCE6DXWAI33W/ url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWKG2VCPJNETVCDTXU4X6FQ2PO6XCNGN/ url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCYKD3JZWWA3ESOZG4PHJJEXT4EYIUIQ/ url