CVE-2022-24729: 
Drupal vulnerability analysis and mitigation

CKEditor4, an open source what-you-see-is-what-you-get HTML editor, contained a vulnerability in the dialog plugin prior to version 4.18.0. The vulnerability (CVE-2022-24729) was discovered by the CKEditor 4 team during their regular security audit and disclosed on March 16, 2022. The issue affected the dialog plugin and any packages with dialog plugin dependency, including Link, Image, Enhanced Image, Code Snippet, and Iframe Dialog (GitHub Advisory).

The vulnerability allowed abuse of a dialog input validator regular expression, which could cause a significant performance drop resulting in a browser tab freeze. This is classified as a Regular expression Denial of Service (ReDoS) vulnerability. The issue has been assigned a CVSS v3.1 base score of 7.5 HIGH by NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, the vulnerability could cause significant performance degradation leading to browser tab freezes, effectively creating a denial of service condition for affected users. The impact primarily affects availability, with no direct impact on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability was patched in CKEditor 4.18.0. Users are strongly recommended to upgrade to this version or later to address the security issue. There were no known workarounds available for this vulnerability prior to the patch (CKEditor Release).