CVE-2024-13245 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Cksource	Ckeditor 4

Configuration 1 [-]

OR	cpe:2.3:a:cksource:ckeditor_4:1.0.0::::lts:drupal::*
	cpe:2.3:a:cksource:ckeditor_4:1.0.1::::lts:drupal::*

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-009

History

Mon, 07 Jul 2025 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cksource Cksource ckeditor 4
CPEs		cpe:2.3:a:cksource:ckeditor_4:1.0.0::::lts:drupal::* cpe:2.3:a:cksource:ckeditor_4:1.0.1::::lts:drupal::*
Vendors & Products		Cksource Cksource ckeditor 4

Thu, 09 Jan 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 19:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.
Title		CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2024-009

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T18:51:18.052Z

Updated: 2025-01-09T21:02:07.840Z

Reserved: 2025-01-09T18:27:07.172Z

Link: CVE-2024-13245

Vulnrichment

Updated: 2025-01-09T21:01:59.384Z

NVD

Status : Analyzed

Published: 2025-01-09T19:15:18.370

Modified: 2025-07-07T15:03:15.680

Link: CVE-2024-13245

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13245", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:27:07.172Z", "datePublished": "2025-01-09T18:51:18.052Z", "dateUpdated": "2025-01-09T21:02:07.840Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/ckeditor_lts", "defaultStatus": "unaffected", "product": "CKEditor 4 LTS - WYSIWYG HTML editor", "repo": "https://git.drupalcode.org/project/ckeditor_lts", "vendor": "Drupal", "versions": [{"lessThan": "1.0.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Juraj Nemec"}, {"lang": "en", "type": "remediation developer", "value": "Wojciech Kukowski"}, {"lang": "en", "type": "remediation developer", "value": "Jacek Bogda\u00c5\u0084ski"}, {"lang": "en", "type": "remediation developer", "value": "Dawid"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "catch"}, {"lang": "en", "type": "coordinator", "value": "cilefen"}], "datePublic": "2024-02-14T19:31:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).<p>This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:51:18.052Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-009"}], "source": {"discovery": "UNKNOWN"}, "title": "CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-09T20:53:13.435542Z", "id": "CVE-2024-13245", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T21:02:07.840Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13245", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-09T20:53:13.435542Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T21:01:59.384Z"}}], "cna": {"title": "CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Juraj Nemec"}, {"lang": "en", "type": "remediation developer", "value": "Wojciech Kukowski"}, {"lang": "en", "type": "remediation developer", "value": "Jacek Bogda\u00c5\u0084ski"}, {"lang": "en", "type": "remediation developer", "value": "Dawid"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "catch"}, {"lang": "en", "type": "coordinator", "value": "cilefen"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/ckeditor_lts", "vendor": "Drupal", "product": "CKEditor 4 LTS - WYSIWYG HTML editor", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/ckeditor_lts", "defaultStatus": "unaffected"}], "datePublic": "2024-02-14T19:31:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-009"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).<p>This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:51:18.052Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13245", "state": "PUBLISHED", "dateUpdated": "2025-01-09T21:02:07.840Z", "dateReserved": "2025-01-09T18:27:07.172Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T18:51:18.052Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}