CVE-2021-26271

CWE-829CWE-13336 documents5 sources
Severity
6.5MEDIUM
EPSS
0.6%
top 30.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Ckeditor CkeditorOracle Application ExpressOracle JD Edwards Enterpriseone Tools+4 more
Timeline
PublishedJan 26
Latest updateMay 24

Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages9 packages

▶npmckeditor4-dev< 4.16
▶NVDckeditor/ckeditor4.0 — 4.16
▶Debianckeditor< 4.16.0+dfsg-1+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
GHSA
CKEditor 4 ReDoS Vulnerability↗2022-05-24
▶
OSV
CKEditor 4 ReDoS Vulnerability↗2022-05-24
▶
CVEList
CVE-2021-26271: It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4↗2021-01-26
▶
OSV
CVE-2021-26271: It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4↗2021-01-26
▶

📋Vendor Advisories

1
Debian
CVE-2021-26271: ckeditor - It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by ...↗2021
▶