CVE-2021-32809
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Score
- CVSS 3.1 5.4 Medium
- Status
- Modified - security-advisories@github.com
- Published
- 2021-08-12
- Last modified
- 2024-08-03
- Weaknesses
- CWE-79, CWE-94
Affected products
- Ckeditor (Ckeditor)
- Ckeditor4 (Ckeditor)
- Fedora (Fedoraproject)
- Application Express (Oracle)
- Banking Party Management (Oracle)
- Commerce Guided Search (Oracle)
- Commerce Merchandising (Oracle)
- Documaker (Oracle)
- Financial Services Analytical Applications Infrastructure (Oracle)
- Jd Edwards Enterpriseone Tools (Oracle)
- Peoplesoft Enterprise Peopletools (Oracle)
References
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77Z…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM2…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A…
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
