CVE-2020-27193

CWE-79 — Cross-site Scripting (XSS)6 documents5 sources
Severity
6.1MEDIUM
EPSS
1.0%
top 22.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Oracle Application ExpressOracle JD Edwards Enterpriseone ToolsOracle Financial Services Analytical Applications Infrastructure+6 more
Timeline
PublishedNov 12
Latest updateMay 24

Description

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages10 packages

▶npmckeditor4< 4.15.1
▶NVDckeditor/ckeditor4.15.0
▶NVDoracle/application_express< 21.1.0.00.01

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
OSV
Improper Neutralization of Input During Web Page Generation in CKEditor4↗2022-05-24
▶
GHSA
Improper Neutralization of Input During Web Page Generation in CKEditor4↗2022-05-24
▶
CVEList
CVE-2020-27193: A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4↗2020-11-12
▶

📋Vendor Advisories

2
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Application Express (CKEditor) — CVE-2020-27193↗2021-07-15
▶
Oracle
Oracle Oracle Commerce Risk Matrix: Experience Manager, Business Control Center (CKEditor) — CVE-2020-27193↗2021-04-15
▶