CVE-2022-24729

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-1333

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-24734.8The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in verCVE-2022-247306.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.CVE-2022-247314.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.CVE-2022-247328.8Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or accouCVE-2022-247336.1Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacCVE-2022-247347.2MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting typeCVE-2022-247357.8Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with accCVE-2022-247365.5Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted CVE-2022-247376.5HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the stateCVE-2022-247387.4Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaCVE-2022-247396.1alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an opCVE-2022-24748.0Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allow