CVE-2023-28439
CVE-2023-28439 is a medium-severity vulnerability in Ckeditor with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.
Key facts
- Severity: Medium (CVSS 3.x base score 4.7)
- EPSS exploit prediction: 1% (50th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-79
- Affected product: Ckeditor
- Published:
- Last modified:
Description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.
Frequently asked questions
- What is CVE-2023-28439?
- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.
- How severe is CVE-2023-28439?
- CVE-2023-28439 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2023-28439 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-28439?
- CVE-2023-28439 primarily affects Ckeditor. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2023-28439?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-28439 published?
- CVE-2023-28439 was published on 2023-03-22 and last updated on 2026-06-17.
References
- https://ckeditor.com/cke4/addon/embed
- https://ckeditor.com/cke4/addon/iframe
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GWKG2VCPJNETVCDTXU4X6FQ2PO6XCNGN/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/L4ODGOW6PYVOXHQSMWJBOCE6DXWAI33W/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VCYKD3JZWWA3ESOZG4PHJJEXT4EYIUIQ/
Affected products (4)
- cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
More vulnerabilities in Ckeditor
- CVE-2023-31541 — Critical (CVSS 9.8): A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor…
- CVE-2021-41165 — High (CVSS 8.2): CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core…
- CVE-2021-41164 — High (CVSS 8.2): CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the…
- CVE-2021-32808 — High (CVSS 7.6): ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the…
- CVE-2011-4972 — High (CVSS 7.5): hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which…
- CVE-2021-37695 — High (CVSS 7.3): ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered…
Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities
- CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
- CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
- CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
- CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
- CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
- CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…
Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →