CKeditor 4.20.2 in use which is vulnerable to CVE-2023-28439

2023-04-1814:37:27

popcorn94

www.huntr.dev

187

ckeditor

version 4.20.2

cve-2023-28439

vulnerability

bug bounty

0.003 Low

EPSS

Percentile

71.5%

JSON

Description

CKeditor 4.20.2 in use which is vulnerable to CVE-2023-28439

Proof of Concept

 1) Go to https://demo.limesurvey.org/tmp/assets/a89a2fb4/ckeditor.js and note that version:"4.20.2"
 2)  Go to https://github.com/LimeSurvey/LimeSurvey/blob/master/assets/packages/ckeditor/ckeditor.js to verify version
 3) Go to https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g which indicate CVE-2023-28439  affects ckeditor &lt; 4.21.0