CVE-2024-24816

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-248175.3Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discour CVE-2024-248185.9EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page CVE-2024-248198.8icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is CVE-2024-24823.7A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerabilit CVE-2024-248208.3Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to ma CVE-2024-248217.8Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included du CVE-2024-248229.1Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. ta CVE-2024-248234.4Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with CVE-2024-248248.8Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can CVE-2024-248257.5DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. Th CVE-2024-248265.0Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds CVE-2024-248277.5Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an