CVE-2024-43369

Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available.

• CWE-79

• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext
• https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-rhm7-7469-rcpw
• https://github.com/ibexa/fieldtype-richtext/commit/0a3b830e8806d5169f697351fdc48ffd95a25c67
• https://github.com/ibexa/fieldtype-richtext/commit/59e9c1a9da60597f60cf7338bf289dccaa7e27ca
• https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7

Published

Aug 16, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43363Cacti is an open source performance and fault management fra…7.2
• CVE-2024-43364Cacti is an open source performance and fault management fra…8.2
• CVE-2024-43365Cacti is an open source performance and fault management fra…8.2
• CVE-2024-43366zkvyper is a Vyper compiler. Starting in version 1.3.12 and …9.1
• CVE-2024-43367Boa is an embeddable and experimental Javascript engine writ…7.5
• CVE-2024-43368The Trix editor, versions prior to 2.1.4, is vulnerable to X…6.5
• CVE-2024-4337Adive Framework 2.0.8, does not sufficiently encode user-con…7.4
• CVE-2024-43370gettext.js is a GNU gettext port for node and the browser. T…7.2
• CVE-2024-43371CKAN is an open-source data management system for powering d…6.5
• CVE-2024-43372Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-43373webcrack is a tool for reverse engineering javascript. An ar…7.8
• CVE-2024-43374The UNIX editor Vim prior to version 9.1.0678 has a use-afte…4.7