CVE catalog

CVE-2024-45613

ckeditor: CVE-2024-45613

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.52% · Oct 25, 2026

CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianckeditorbookworm4.19.1+dfsg-1not affected
Debianckeditor3bookworm3.6.6.1+dfsg-7not affected
Ubuntuldap-account-manager16.044.9-1vulnerable
Ubuntuldap-account-manager16.045.1-1vulnerable
Ubuntuldap-account-manager16.045.2-1vulnerable
Ubuntuldap-account-manager16.045.2-1ubuntu1vulnerable
Ubunturequest-tracker416.044.2.11-2vulnerable
Ubunturequest-tracker416.044.2.12-3vulnerable
Ubunturequest-tracker416.044.2.12-4vulnerable
Ubunturequest-tracker416.044.2.12-5vulnerable
Ubuntuckeditor318.043.6.6.1+dfsg-1vulnerable
Ubuntuldap-account-manager18.045.7-1vulnerable
Ubuntuldap-account-manager18.046.1-1vulnerable
Ubuntuldap-account-manager18.046.2-1vulnerable
Ubunturequest-tracker4pro4.4.1-5vulnerable
Ubunturequest-tracker4pro4.4.2-1vulnerable
Ubunturequest-tracker4pro4.4.2-2vulnerable
Ubunturequest-tracker4pro4.4.2-2ubuntu0.1~esm1vulnerable
Ubuntuckeditor320.043.6.6.1+dfsg-3vulnerable
Ubuntuckeditor320.043.6.6.1+dfsg-4vulnerable
Ubuntuldap-account-manager20.046.7-1vulnerable
Ubunturequest-tracker420.044.4.3-2vulnerable
Ubunturequest-tracker420.044.4.3-2+deb10u3build0.20.04.1vulnerable
Ubuntuckeditor322.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager22.047.5-1vulnerable
Ubuntuldap-account-manager22.047.7-1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1.22.04.1vulnerable
Ubuntuckeditor324.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager24.048.3-1vulnerable
Ubuntuldap-account-manager24.048.5-1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu2vulnerable
Ubunturequest-tracker424.044.4.7+dfsg-1vulnerable
Ubuntuldap-account-manager25.109.0-1vulnerable
Ubunturequest-tracker425.104.4.7+dfsg-4syncable1vulnerable
Ubuntuldap-account-manager26.049.0-1vulnerable
Ubuntuldap-account-manager26.049.0-1build1vulnerable
Ubunturequest-tracker426.044.4.7+dfsg-4syncable1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianckeditorsourcebookwormNot affectedunimportantNot reportedNot reported
Debianckeditor3sourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ckeditor]Not affected
    Details (2)

    • 4.19.1+dfsg-1 · all · bookworm

      Not affected

      dsa · ckeditor · debian · bookworm

    • 4.19.1+dfsg-1 · all · bookworm

      Not affected

      dsa · ckeditor · debian · bookworm

  • [ckeditor3]Not affected
    Details (2)

    • 3.6.6.1+dfsg-7 · all · bookworm

      Not affected

      dsa · ckeditor3 · debian · bookworm

    • 3.6.6.1+dfsg-7 · all · bookworm

      Not affected

      dsa · ckeditor3 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]