{"id":"CVE-2022-24729","published":"2022-03-16T00:00:00Z","modified":"2025-04-23T18:53:35Z","title":"Regular expression Denial of Service in dialog plugin","vendor":"ckeditor","product":"ckeditor4","tier":"tail","description":{"text":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02487,"percentile":0.84561,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://ckeditor.com/cke4/release/CKEditor-4.18.0","tags":[]},{"url":"https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":[]},{"url":"https://www.drupal.org/sa-core-2022-005","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/","tags":["vendor-advisory"]}],"priority":{"score":21.5,"factors":[{"name":"EPSS percentile","points":16.91},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"ckeditor","affectedVersions":[{"vendor":"ckeditor","product":"ckeditor4","versions":["< 4.18.0"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <9.2.15",">=9.3.0, <9.3.8"],"patched":["9.2.15","9.3.8"],"from":["DRUPAL-CORE-2022-005"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-29580","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ckeditor4-cve-2021-41165","parents":[{"from":"CVE-2022-24728","to":"CVE-2022-24729","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-4fc4-4p5g-6w89","via":"reference","url":"https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89"}]}],"packageHistory":[{"cve":"CVE-2022-25270","published":"2022-02-16","fixed":"9.3.6","kev":false},{"cve":"CVE-2022-25271","published":"2022-02-16","fixed":"9.3.6","kev":false,"link":{"from":"CVE-2022-25271","to":"CVE-2022-24729","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"9.2.13","toFixed":"9.2.15","daysApart":28}]}},{"cve":"CVE-2022-24728","published":"2022-03-16","fixed":"9.3.8","kev":false},{"cve":"CVE-2022-24729","published":"2022-03-16","fixed":"9.3.8","kev":false},{"cve":"CVE-2022-24775","published":"2022-03-21","fixed":"9.3.9","kev":false},{"cve":"CVE-2022-25273","published":"2023-04-26","fixed":"9.3.12","kev":false},{"cve":"CVE-2022-25274","published":"2023-04-26","fixed":"9.3.12","kev":false}],"package":"Packagist:drupal/core"}}