CVE-2021-32809
Medium
Description
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
SeverityMedium
CVSS4.6
Exploit probability—
Product
Ckeditor
PublishedAug 12, 2021
First seenAug 12, 2021
Weakness typeCWE-94Code injection
How to fix
Update
- ckeditor ckeditor4.16.2 or later
- oracle application_express21.1.4 or later
- oracle jd_edwards_enterpriseone_tools9.2.6.0 or later
- ckeditor44.16.2 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ckeditor ckeditor | 4.5.2 ≤ v < 4.16.2 | 4.16.2 |
| fedoraproject fedora | 33, 34, 35 | — |
| oracle application_express | v < 21.1.4 | 21.1.4 |
| oracle banking_party_management | 2.7.0 | — |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle commerce_merchandising | 11.3.2 | — |
| oracle documaker | 12.6.3, 12.6.4 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.7 ≤ v ≤ 8.1.1 | — |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.6.0 | 9.2.6.0 |
| oracle peoplesoft_enterprise_peopletools | 8.57, 8.58, 8.59 | — |
| ckeditor4npm | 4.5.2 ≤ v < 4.16.2 | 4.16.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.