CVE catalog

CVE-2022-24729

ckeditor: CVE-2022-24729

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.49% · Oct 25, 2026

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianckeditorbookworm4.19.1+dfsg-1fixed
Debianckeditor3bookworm3.6.6.1+dfsg-7not affected
Ubuntuldap-account-manager16.044.9-1vulnerable
Ubuntuldap-account-manager16.045.1-1vulnerable
Ubuntuldap-account-manager16.045.2-1vulnerable
Ubuntuldap-account-manager16.045.2-1ubuntu1vulnerable
Ubunturequest-tracker416.044.2.11-2vulnerable
Ubunturequest-tracker416.044.2.12-3vulnerable
Ubunturequest-tracker416.044.2.12-4vulnerable
Ubunturequest-tracker416.044.2.12-5vulnerable
Ubuntuckeditor318.043.6.6.1+dfsg-1vulnerable
Ubuntuldap-account-manager18.045.7-1vulnerable
Ubuntuldap-account-manager18.046.1-1vulnerable
Ubuntuldap-account-manager18.046.2-1vulnerable
Ubunturequest-tracker4pro4.4.1-5vulnerable
Ubunturequest-tracker4pro4.4.2-1vulnerable
Ubunturequest-tracker4pro4.4.2-2vulnerable
Ubunturequest-tracker4pro4.4.2-2ubuntu0.1~esm1vulnerable
Ubuntuckeditor320.043.6.6.1+dfsg-3vulnerable
Ubuntuckeditor320.043.6.6.1+dfsg-4vulnerable
Ubuntuldap-account-manager20.046.7-1vulnerable
Ubunturequest-tracker420.044.4.3-2vulnerable
Ubunturequest-tracker420.044.4.3-2+deb10u3build0.20.04.1vulnerable
Ubuntuckeditor322.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager22.047.5-1vulnerable
Ubuntuldap-account-manager22.047.7-1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1.22.04.1vulnerable
Ubuntuckeditor324.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager24.048.3-1vulnerable
Ubuntuldap-account-manager24.048.5-1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu2vulnerable
Ubunturequest-tracker424.044.4.7+dfsg-1vulnerable
Ubuntuldap-account-manager25.109.0-1vulnerable
Ubunturequest-tracker425.104.4.7+dfsg-4syncable1vulnerable
Ubuntuldap-account-manager26.049.0-1vulnerable
Ubuntuldap-account-manager26.049.0-1build1vulnerable
Ubunturequest-tracker426.044.4.7+dfsg-4syncable1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianckeditorsourcebookworm4.19.0+dfsg-1not yet assignedNot reportedNot reported
Debianckeditor3sourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ckeditor]Fixed
    Details (2)

    • 4.19.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 4.19.0+dfsg-1

      dsa · ckeditor · debian · bookworm

    • 4.19.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 4.19.0+dfsg-1

      dsa · ckeditor · debian · bookworm

  • [ckeditor3]Not affected
    Details (2)

    • 3.6.6.1+dfsg-7 · all · bookworm

      Not affected

      dsa · ckeditor3 · debian · bookworm

    • 3.6.6.1+dfsg-7 · all · bookworm

      Not affected

      dsa · ckeditor3 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]