CVE catalog
CVE-2024-43411
CKEditor vulnerabilities
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.43% · Oct 25, 2026
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ckeditor | bookworm | 4.19.1+dfsg-1 | not affected |
| Ubuntu | ckeditor | noble | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | ldap-account-manager | 16.04 | 4.9-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.1-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.2-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.2-1ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.11-2 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-3 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-4 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-5 | vulnerable |
| Ubuntu | ckeditor3 | 18.04 | 3.6.6.1+dfsg-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 5.7-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 6.1-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 6.2-1 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.1-5 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-1 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-2 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-2ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ckeditor3 | 20.04 | 3.6.6.1+dfsg-3 | vulnerable |
| Ubuntu | ckeditor3 | 20.04 | 3.6.6.1+dfsg-4 | vulnerable |
| Ubuntu | ldap-account-manager | 20.04 | 6.7-1 | vulnerable |
| Ubuntu | request-tracker4 | 20.04 | 4.4.3-2 | vulnerable |
| Ubuntu | request-tracker4 | 20.04 | 4.4.3-2+deb10u3build0.20.04.1 | vulnerable |
| Ubuntu | ckeditor3 | 22.04 | 3.6.6.1+dfsg-7 | vulnerable |
| Ubuntu | ldap-account-manager | 22.04 | 7.5-1 | vulnerable |
| Ubuntu | ldap-account-manager | 22.04 | 7.7-1 | vulnerable |
| Ubuntu | request-tracker4 | 22.04 | 4.4.4+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 22.04 | 4.4.4+dfsg-2ubuntu1.22.04.1 | vulnerable |
| Ubuntu | ckeditor3 | 24.04 | 3.6.6.1+dfsg-7 | vulnerable |
| Ubuntu | ldap-account-manager | 24.04 | 8.3-1 | vulnerable |
| Ubuntu | ldap-account-manager | 24.04 | 8.5-1 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.4+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.4+dfsg-2ubuntu2 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.7+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm2 | vulnerable |
| Ubuntu | ckeditor | 25.10 | 4.22.1+dfsg1-2ubuntu1 | vulnerable |
| Ubuntu | ckeditor | 25.10 | 4.22.1+dfsg1-2ubuntu1.1 | vulnerable |
| Ubuntu | ldap-account-manager | 25.10 | 9.0-1 | vulnerable |
| Ubuntu | request-tracker4 | 25.10 | 4.4.7+dfsg-4syncable1 | vulnerable |
| Ubuntu | ldap-account-manager | 26.04 | 9.0-1 | vulnerable |
| Ubuntu | ldap-account-manager | 26.04 | 9.0-1build1 | vulnerable |
| Ubuntu | request-tracker4 | 26.04 | 4.4.7+dfsg-4syncable1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ckeditor | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Ubuntu | ckeditor | deb | noble | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ckeditor]Not affected
Details (2)
4.19.1+dfsg-1· all · bookwormNot affected
usn · ckeditor · debian · bookworm
4.19.1+dfsg-1· all · bookwormNot affected
usn · ckeditor · debian · bookworm
Observed: