{"id":"DRUPAL-CONTRIB-2024-009","aliases":["CVE-2024-13245"],"title":"The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing.","titleSource":"OSV","descriptionSource":"OSV","description":"The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a [security update](https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS) that on certain configurations may impact the Drupal module that bundles and integrates this code.\n\nThe vulnerability is mitigated by the fact it requires:\n\n1. [full-page editing](https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) mode is enabled\n2. or CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements) are enabled.\n3. An attacker must have a permission with access to the CKEditor instance.\n\nFor more information, see CKEditor's security advisory:  \n[CVE-2024-24815](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm): Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection","severity":"unknown","score":null,"published":"2024-02-14T19:31:10.000Z","modified":"2026-09-10T03:45:35.923Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/ckeditor_lts","sources":[{"name":"OSV · DRUPAL-CONTRIB-2024-009","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2024-009"}],"ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=1.0.0 <1.0.1"}}],"versions":[],"fixed":["1.0.1"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2024-009"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2024-009","modified":"2026-09-10T03:45:35.923526658Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2024-009"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:15:32.897Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}