CVE:CVE-2022-24728
CNNVD:CNNVD-202203-1546
CKEditor是一套开源的、基于网页的文字编辑器。
CKEditor 4 4.18.0之前版本 存在跨站脚本漏洞，该漏洞源于在核心 HTML 处理模块中发现了一个漏洞，该漏洞影响CKEditor4 4.18.0之前版本使用的所有插件。该漏洞允许攻击者绕过内容清理注入格式错误的 HTML，从而导致执行 JavaScript 代码。
solution:Upgrade ckeditor ckeditor to a higher version than 4.18.0,and avoid the version [4.0,4.18.0); Upgrade drupal drupal to a higher version than 9.2.15,9.3.8,and avoid the version [8.0.0,9.2.15),[9.3.0,9.3.8); Upgrade oracle application_express to a higher version than 22.1.1,and avoid the version (,22.1.1); Upgrade oracle commerce_merchandising to a higher version than 11.3.2,and avoid the version 11.3.2; Upgrade oracle financial_services_analytical_applications_infrastructure to a higher version than 8.1.0.0.0,8.1.1.0,8.1.2.0,8.1.2.1,and avoid the version [8.0.7.0.0,8.1.0.0.0],8.1.1.0,8.1.2.0,8.1.2.1; Upgrade oracle financial_services_behavior_detection_platform to a higher version than 8.1.2.1,8.0.7.0,8.0.8.0,and avoid the version [8.1.1.0,8.1.2.1],8.0.7.0,8.0.8.0; Upgrade oracle financial_services_trade-based_anti_money_laundering to a higher version than 8.0.7,8.0.8,and avoid the version 8.0.7,8.0.8; Upgrade oracle peoplesoft_enterprise_peopletools to a higher version than 8.58,8.59,and avoid the version 8.58,8.59; Upgrade fedoraproject fedora to a higher version than 36,37,and avoid the version 36,37