CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7258-1 advisory.

    Kevin Backhouse discovered that CKEditor did not properly sanitize HTML content. An attacker could     possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24728)

    It was discovered that CKEditor did not properly handle the creation of editor instances in the Iframe     Dialog and Media Embed packages. An attacker could possibly use this issue to perform cross site scripting     and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28439)

    It was discovered that CKEditor did not properly handle parsing HTML content. An attacker could possibly     use this issue to perform cross site scripting and obtain sensitive information. (CVE-2024-24815,     CVE-2024-24816)

    It was discovered that CKEditor did not properly sanitize version notifications. An attacker could     possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only     affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI (Apache Tomcat)).
    Supported versions that are affected are 24.7 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP/2 to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Integration. (CVE-2024-24549)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: User Interface     (CKEditor)). Supported versions that are affected are 24.7 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset     of Siebel Apps - Marketing accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-426b3a500d advisory.

    - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1)
    - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0)
        - [GHSA-vh5c-xwqv-cv9g /     CVE-2023-28439](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g)
    - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2)
    - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-79b5902a52 advisory.

    - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1)
    - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0)
        - [GHSA-vh5c-xwqv-cv9g /     CVE-2023-28439](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g)
    - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2)
    - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-983ff03630 advisory.

    - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1)
    - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0)
        - [GHSA-vh5c-xwqv-cv9g /     CVE-2023-28439](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g)
    - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2)
    - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 and 7.0.0.0 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (jackson-databind)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (CKEditor)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
215049	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : CKEditor vulnerabilities (USN-7258-1)	Nessus	Ubuntu Local Security Checks	medium
209246	Oracle Siebel CRM <= 24.7 (October 2024 CPU)	Nessus	Misc.	medium
185267	Fedora 39 : ckeditor (2023-426b3a500d)	Nessus	Fedora Local Security Checks	medium
182545	Fedora 38 : ckeditor (2023-79b5902a52)	Nessus	Fedora Local Security Checks	medium
182542	Fedora 37 : ckeditor (2023-983ff03630)	Nessus	Fedora Local Security Checks	medium
178710	Oracle Business Intelligence Enterprise Edition (OAS) (July 2023 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-28439

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical