--- cve: "CVE-2023-28439" severity: "MEDIUM" cvss: 4.7 epss: "73%" vendor: "ckeditor" kev: false exploited: false published: "2023-03-22 21:15:18" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-18T08:40:37+02:00" --- # CVE-2023-28439 > 4.7 MEDIUM · 🧪 PoC ## Beschreibung CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Hoch | good | | PR Privilegien | Keine | bad | | UI Interaktion | Erforderlich | good | | S Scope | Verändert | bad | | C Vertraulichkeit | Gering | warn | | I Integrität | Gering | warn | | A Verfügbarkeit | Keine | good | ## Patch verfügbar (OSV) - d529d176d70016ce8bcf51eb87ce7802a05fe5f9 (Commit) - 6bf35758a39efddcf8ffaa92e2a6cc1cd6696fbd (Commit) ## Referenzen - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2023-28439) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_