CVE-2022-24729

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-1333

Affected software

Vendor	Product	Versions
ckeditor	ckeditor4	< 4.18.0

References

https://ckeditor.com/cke4/release/CKEditor-4.18.0Release Notes, Vendor Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hhThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
https://www.drupal.org/sa-core-2022-005Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://ckeditor.com/cke4/release/CKEditor-4.18.0Release Notes, Vendor Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hhThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
https://www.drupal.org/sa-core-2022-005Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Timeline

Published: Mar 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-24734.8The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in ver CVE-2022-247306.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.CVE-2022-247314.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.CVE-2022-247328.8Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or accou CVE-2022-247336.1Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attac CVE-2022-247347.2MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting type CVE-2022-247357.8Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with acc CVE-2022-247365.5Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted CVE-2022-247376.5HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state CVE-2022-247387.4Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain uncla CVE-2022-247396.1alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an op CVE-2022-24748.0Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allow