CVE-2021-32809 — Code Injection in Ckeditor

CWE-94 — Code InjectionCWE-79 — Cross-site Scripting11 documents6 sources
Severity
5.4MEDIUMNVD
CNA4.6OSV6.1
EPSS
0.2%
top 53.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
CkeditorOracle Application ExpressOracle JD Edwards Enterpriseone Tools+9 more
Timeline
PublishedAug 12
Latest updateMar 23

Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in ver…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages14 packages

▶NVDckeditor/ckeditor4.5.2 — 4.16.2
▶npmckeditor/ckeditor44.5.2 — 4.16.2
▶Debianckeditor/ckeditor< 4.16.2+dfsg-1
▶Ubuntuckeditor/ckeditor< 4.5.7+dfsg-2ubuntu0.16.04.1~esm1
▶CVEListV5ckeditor/ckeditor4>= 4.5.2, < 4.16.2

Also affects: Fedora 33, 34, 35

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

7
OSV
ckeditor vulnerabilities↗2022-03-23
▶
GHSA
CKEditor 4 vulnerabilities in versions <4.16.1↗2021-08-23
▶
OSV
CKEditor 4 vulnerabilities in versions <4.16.1↗2021-08-23
▶
OSV
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality↗2021-08-23
▶
GHSA
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality↗2021-08-23
▶

📋Vendor Advisories

3
Ubuntu
CKEditor vulnerabilities↗2022-03-23
▶
Ubuntu
CKEditor vulnerabilities↗2022-03-22
▶
Debian
CVE-2021-32809: ckeditor - ckeditor is an open source WYSIWYG HTML editor with rich content support. A pote...↗2021
▶