Catalogo CVE

CVE-2022-31175

UBUNTU-

[Catalogo CVE]

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `<textarea>` as a base. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are no known workarounds for this issue.

Gravità
Sconosciuto
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.88% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntuprorequest-tracker44.4.1-5Affected[UBUNTU-CVE-2022-31175]
Ubuntuprorequest-tracker44.4.2-1Affected[UBUNTU-CVE-2022-31175]
Ubuntuprorequest-tracker44.4.2-2Affected[UBUNTU-CVE-2022-31175]
Ubuntuprorequest-tracker44.4.2-2ubuntu0.1~esm1Affected[UBUNTU-CVE-2022-31175]
Ubuntu26.04ldap-account-manager9.0-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu26.04ldap-account-manager9.0-1build1Affected[UBUNTU-CVE-2022-31175]
Ubuntu26.04request-tracker44.4.7+dfsg-4syncable1Affected[UBUNTU-CVE-2022-31175]
Ubuntu25.10ldap-account-manager9.0-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu25.10request-tracker44.4.7+dfsg-4syncable1Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04ckeditor33.6.6.1+dfsg-7Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04ldap-account-manager8.3-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04ldap-account-manager8.5-1Affected[UBUNTU-CVE-2022-31175]

Showing 12 observations. All 37 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Ubuntu16.04ldap-account-manager4.9-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu16.04ldap-account-manager5.1-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu16.04ldap-account-manager5.2-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu16.04ldap-account-manager5.2-1ubuntu1Affected[UBUNTU-CVE-2022-31175]
Ubuntu16.04request-tracker44.2.11-2Affected[UBUNTU-CVE-2022-31175]
Ubuntu16.04request-tracker44.2.12-3Affected[UBUNTU-CVE-2022-31175]
Ubuntu16.04request-tracker44.2.12-4Affected[UBUNTU-CVE-2022-31175]
Ubuntu16.04request-tracker44.2.12-5Affected[UBUNTU-CVE-2022-31175]
Ubuntu18.04ckeditor33.6.6.1+dfsg-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu18.04ldap-account-manager5.7-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu18.04ldap-account-manager6.1-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu18.04ldap-account-manager6.2-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu20.04ckeditor33.6.6.1+dfsg-3Affected[UBUNTU-CVE-2022-31175]
Ubuntu20.04ckeditor33.6.6.1+dfsg-4Affected[UBUNTU-CVE-2022-31175]
Ubuntu20.04ldap-account-manager6.7-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu20.04request-tracker44.4.3-2Affected[UBUNTU-CVE-2022-31175]
Ubuntu20.04request-tracker44.4.3-2+deb10u3build0.20.04.1Affected[UBUNTU-CVE-2022-31175]
Ubuntu22.04ckeditor33.6.6.1+dfsg-7Affected[UBUNTU-CVE-2022-31175]
Ubuntu22.04ldap-account-manager7.5-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu22.04ldap-account-manager7.7-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu22.04request-tracker44.4.4+dfsg-2ubuntu1Affected[UBUNTU-CVE-2022-31175]
Ubuntu22.04request-tracker44.4.4+dfsg-2ubuntu1.22.04.1Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04ckeditor33.6.6.1+dfsg-7Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04ldap-account-manager8.3-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04ldap-account-manager8.5-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04request-tracker44.4.4+dfsg-2ubuntu1Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04request-tracker44.4.4+dfsg-2ubuntu2Affected[UBUNTU-CVE-2022-31175]
Ubuntu24.04request-tracker44.4.7+dfsg-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu25.10ldap-account-manager9.0-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu25.10request-tracker44.4.7+dfsg-4syncable1Affected[UBUNTU-CVE-2022-31175]
Ubuntu26.04ldap-account-manager9.0-1Affected[UBUNTU-CVE-2022-31175]
Ubuntu26.04ldap-account-manager9.0-1build1Affected[UBUNTU-CVE-2022-31175]
Ubuntu26.04request-tracker44.4.7+dfsg-4syncable1Affected[UBUNTU-CVE-2022-31175]
Ubuntuprorequest-tracker44.4.1-5Affected[UBUNTU-CVE-2022-31175]
Ubuntuprorequest-tracker44.4.2-1Affected[UBUNTU-CVE-2022-31175]
Ubuntuprorequest-tracker44.4.2-2Affected[UBUNTU-CVE-2022-31175]
Ubuntuprorequest-tracker44.4.2-2ubuntu0.1~esm1Affected[UBUNTU-CVE-2022-31175]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "ldap-account-manager",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "4.9-1",
        "5.1-1",
        "5.2-1",
        "5.2-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "request-tracker4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "4.2.11-2",
        "4.2.12-3",
        "4.2.12-4",
        "4.2.12-5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ckeditor3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "3.6.6.1+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ldap-account-manager",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "5.7-1",
        "6.1-1",
        "6.2-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "request-tracker4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4.4.1-5",
        "4.4.2-1",
        "4.4.2-2",
        "4.4.2-2ubuntu0.1~esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ckeditor3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "3.6.6.1+dfsg-3",
        "3.6.6.1+dfsg-4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ldap-account-manager",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "6.7-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "request-tracker4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "4.4.3-2",
        "4.4.3-2+deb10u3build0.20.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ckeditor3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3.6.6.1+dfsg-7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ldap-account-manager",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "7.5-1",
        "7.7-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "request-tracker4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "4.4.4+dfsg-2ubuntu1",
        "4.4.4+dfsg-2ubuntu1.22.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ckeditor3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "3.6.6.1+dfsg-7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ldap-account-manager",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "8.3-1",
        "8.5-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "request-tracker4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "4.4.4+dfsg-2ubuntu1",
        "4.4.4+dfsg-2ubuntu2",
        "4.4.7+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ldap-account-manager",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "9.0-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "request-tracker4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "4.4.7+dfsg-4syncable1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "ldap-account-manager",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "9.0-1",
        "9.0-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    },
    {
      "name": "request-tracker4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "4.4.7+dfsg-4syncable1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31175",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31175",
      "provider_updated_at": "2026-05-20T16:08:06.544953475Z"
    }
  ]
}

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

Osservato:

Riferimenti

[FIRST EPSS] · [OSV Package Vulnerability Database]