CVE catalog
CVE-2022-24728
CKEditor vulnerabilities
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.20% · Oct 25, 2026
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ckeditor | bookworm | 4.19.1+dfsg-1 | fixed |
| Debian | ckeditor3 | bookworm | 3.6.6.1+dfsg-7 | vulnerable |
| Ubuntu | ckeditor3 | noble | Not reported | vulnerable |
| Ubuntu | ckeditor | noble | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | ckeditor | pro | 4.16.0+dfsg-2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.16.2+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.16.2+dfsg-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.16.2+dfsg-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 4.9-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.1-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.2-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.2-1ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.11-2 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-3 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-4 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-5 | vulnerable |
| Ubuntu | ckeditor3 | 18.04 | 3.6.6.1+dfsg-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 5.7-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 6.1-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 6.2-1 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.1-5 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-1 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-2 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-2ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ckeditor3 | 20.04 | 3.6.6.1+dfsg-3 | vulnerable |
| Ubuntu | ckeditor3 | 20.04 | 3.6.6.1+dfsg-4 | vulnerable |
| Ubuntu | ldap-account-manager | 20.04 | 6.7-1 | vulnerable |
| Ubuntu | request-tracker4 | 20.04 | 4.4.3-2 | vulnerable |
| Ubuntu | request-tracker4 | 20.04 | 4.4.3-2+deb10u3build0.20.04.1 | vulnerable |
| Ubuntu | ckeditor3 | 22.04 | 3.6.6.1+dfsg-7 | vulnerable |
| Ubuntu | ldap-account-manager | 22.04 | 7.5-1 | vulnerable |
| Ubuntu | ldap-account-manager | 22.04 | 7.7-1 | vulnerable |
| Ubuntu | request-tracker4 | 22.04 | 4.4.4+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 22.04 | 4.4.4+dfsg-2ubuntu1.22.04.1 | vulnerable |
| Ubuntu | ckeditor3 | 24.04 | 3.6.6.1+dfsg-7 | vulnerable |
| Ubuntu | ldap-account-manager | 24.04 | 8.3-1 | vulnerable |
| Ubuntu | ldap-account-manager | 24.04 | 8.5-1 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.4+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.4+dfsg-2ubuntu2 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.7+dfsg-1 | vulnerable |
| Ubuntu | ldap-account-manager | 25.10 | 9.0-1 | vulnerable |
| Ubuntu | request-tracker4 | 25.10 | 4.4.7+dfsg-4syncable1 | vulnerable |
| Ubuntu | ldap-account-manager | 26.04 | 9.0-1 | vulnerable |
| Ubuntu | ldap-account-manager | 26.04 | 9.0-1build1 | vulnerable |
| Ubuntu | request-tracker4 | 26.04 | 4.4.7+dfsg-4syncable1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ckeditor | source | bookworm | 4.19.0+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | ckeditor3 | source | bookworm | (unfixed) | not yet assigned | Not reported | [1015217] |
| Ubuntu | ckeditor | deb | noble | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | ckeditor | deb | pro | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | Not reported | USN-7258-1 | Not reported |
Notes
[bookworm] ckeditor3: Minor issue, only used by Horde editor
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ckeditor3]Affected
Details (2)
3.6.6.1+dfsg-7· all · bookwormAffected
usn · ckeditor3 · debian · bookworm
3.6.6.1+dfsg-7· all · bookwormAffected
usn · ckeditor3 · debian · bookworm
- [ckeditor]Fixed
Details (2)
4.19.1+dfsg-1· all · bookwormFixed · Fixed:
4.19.0+dfsg-1usn · ckeditor · debian · bookworm
4.19.1+dfsg-1· all · bookwormFixed · Fixed:
4.19.0+dfsg-1usn · ckeditor · debian · bookworm
Observed:
References
- [https://osv.dev/vulnerability/UBUNTU-CVE-2022-24728]
- [https://osv.dev/vulnerability/USN-7258-1]
- [https://security-tracker.debian.org/tracker/CVE-2022-24728]
- [https://ubuntu.com/security/notices/USN-7258-1]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]