CVE-2021-26272

CWE-8298 documents6 sources
Severity
6.5MEDIUM
EPSS
0.5%
top 33.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Ckeditor CkeditorOracle Application ExpressOracle JD Edwards Enterpriseone Tools+7 more
Timeline
PublishedJan 26
Latest updateOct 15

Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages12 packages

▶npmckeditor4< 4.16.0
▶NVDckeditor/ckeditor4.0 — 4.16
▶Debianckeditor< 4.16.0+dfsg-1+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
GHSA
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4↗2021-10-13
▶
OSV
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4↗2021-10-13
▶
OSV
CVE-2021-26272: It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4↗2021-01-26
▶
CVEList
CVE-2021-26272: It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4↗2021-01-26
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Application Express (CKEditor) — CVE-2021-26272↗2021-10-15
▶
Oracle
Oracle Oracle Commerce Risk Matrix: Experience Manager, Business Control Center (CKEditor) — CVE-2021-26272↗2021-07-15
▶
Debian
CVE-2021-26272: ckeditor - It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by ...↗2021
▶