CVE-2023-4771
Fixed upstream EPSS <1%CVSS 6.1
A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.
Products: CKSource CKEditor
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | ckeditor4 | 4.24.0-lts |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ckeditor | no fix |
| Ubuntu 16.04 LTS | ldap-account-manager | no fix |
| Ubuntu 16.04 LTS | request-tracker4 | no fix |
| Ubuntu 18.04 LTS | ckeditor3 | no fix |
| Ubuntu 18.04 LTS | ldap-account-manager | no fix |
| Ubuntu 20.04 LTS | ckeditor3 | no fix |
| Ubuntu 20.04 LTS | ldap-account-manager | no fix |
| Ubuntu 20.04 LTS | request-tracker4 | no fix |
| Ubuntu 22.04 LTS | ckeditor3 | no fix |
| Ubuntu 22.04 LTS | ldap-account-manager | no fix |
| Ubuntu 22.04 LTS | request-tracker4 | no fix |
| Ubuntu 24.04 LTS | ckeditor3 | no fix |
| Ubuntu 24.04 LTS | ldap-account-manager | no fix |
| Ubuntu 24.04 LTS | request-tracker4 | no fix |
| Ubuntu 25.10 | ldap-account-manager | no fix |
| Ubuntu 25.10 | request-tracker4 | no fix |
| Ubuntu 26.04 LTS | ldap-account-manager | no fix |
| Ubuntu 26.04 LTS | request-tracker4 | no fix |
| Ubuntu Pro 16.04 LTS | ckeditor | no fix |
| Ubuntu Pro 18.04 LTS | ckeditor | no fix |
| Ubuntu Pro 18.04 LTS | request-tracker4 | no fix |
| Ubuntu Pro 20.04 LTS | ckeditor | no fix |