CVE-2020-27193
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2020-11-12
- Last modified
- 2024-08-04
- Weaknesses
- CWE-79
Affected products
- Ckeditor (Ckeditor)
- Agile Product Lifecycle Management (Oracle)
- Application Express (Oracle)
- Banking Party Management (Oracle)
- Banking Platform (Oracle)
- Commerce Merchandising (Oracle)
- Financial Services Analytical Applications Infrastructure (Oracle)
- Jd Edwards Enterpriseone Tools (Oracle)
- Peoplesoft Enterprise Peopletools (Oracle)
References
- https://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/
- https://ckeditor.com/cke4/release/CKEditor-4.15.1
- https://ckeditor.com/ckeditor-4/download/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
