CVE-2022-24729 : faille élevée ckeditor ckeditor (CVSS 7.5)

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Sévérité

Élevée (CVSS 7.5)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitation active

Non signalée par la CISA

Publication

16 mars 2022

Dernière mise à jour

17 juin 2026

• ckeditor ckeditor
• drupal drupal
• oracle application express
• oracle commerce merchandising
• oracle financial services analytical applications infrastructure
• oracle financial services behavior detection platform
• oracle financial services trade-based anti money laundering
• oracle peoplesoft enterprise peopletools
• fedoraproject fedora

• Fiche CVE-2022-24729 sur le NVD (NIST)
• ckeditor.com/cke4/release/CKEditor-4.18.0
• github.com/ckeditor/ckeditor4/security/advisories/GHSA…
• lists.fedoraproject.org/archives/list/package…
• lists.fedoraproject.org/archives/list/package…
• drupal.org/sa-core-2022-005
• oracle.com/security-alerts/cpujul2022.html