CVE-2021-37695
published 2021-08-13CVE-2021-37695: ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
1.32%
67.8th percentile
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ckeditor | ckeditor | < 4.16.2 | 4.16.2 |
| ckeditor | ckeditor | >= 0 < 4.16.2+dfsg-1 | 4.16.2+dfsg-1 |
| ckeditor | ckeditor | >= 0 < 4.5.7+dfsg-2ubuntu0.18.04.1 | 4.5.7+dfsg-2ubuntu0.18.04.1 |
| ckeditor | ckeditor | >= 0 < 4.12.1+dfsg-1ubuntu0.1 | 4.12.1+dfsg-1ubuntu0.1 |
| ckeditor | ckeditor | >= 0 < 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 | 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 |
| ckeditor | ckeditor4 | < 4.16.2 | 4.16.2 |
| ckeditor | ckeditor4 | >= 0 < 4.16.2 | 4.16.2 |
| debian | ckeditor | < ckeditor 4.16.2+dfsg-1 (bookworm) | ckeditor 4.16.2+dfsg-1 (bookworm) |
| debian | ckeditor3 | < ckeditor 4.16.2+dfsg-1 (bookworm) | ckeditor 4.16.2+dfsg-1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | application_express | < 21.1.4 | 21.1.4 |
| oracle | banking_party_management | — | — |
| oracle | commerce_guided_search | — | — |
| oracle | commerce_merchandising | — | — |
| oracle | documaker | — | — |
| oracle | documaker | — | — |
| oracle | financial_services_analytical_applications_infrastructure | — | — |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.7 – 8.1.1 | — |
| oracle | financial_services_model_management_and_governance | 8.0.8.0.0 – 8.1.0.0.0 | — |
| oracle | jd_edwards_enterpriseone_tools | < 9.2.6.0 | 9.2.6.0 |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
ghsa5.4MEDIUM
osv6.1MEDIUM
vendor_debian7.3HIGH
vendor_ubuntu6.1MEDIUM
vendor_oracle5.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ckeditor vulnerabilities
osv·2022-03-23·CVSS 6.1
CVE-2018-9861 [MEDIUM] ckeditor vulnerabilities
ckeditor vulnerabilities
USN-5340-1 fixed several vulnerabilities in CKEditor.
This update provides the fixes for CVE-2018-9861, CVE-2020-9281,
CVE-2021-32809, CVE-2021-33829 and CVE-2021-37695 for Ubuntu 16.04 ESM.
Original advisory details:
Kyaw Min Thein discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue
to execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
ex
OSV
ckeditor vulnerabilities
osv·2022-03-22·CVSS 6.1
CVE-2018-9861 [MEDIUM] ckeditor vulnerabilities
ckeditor vulnerabilities
Kyaw Min Thein discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue
to execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 21.10. (CVE-2021-32808)
Anton Subbotin discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
inject arbitrary code
GHSA
CKEditor 4 vulnerabilities in versions <4.16.1
ghsa·2021-08-23·CVSS 5.4
CVE-2021-37695 [MEDIUM] CKEditor 4 vulnerabilities in versions <4.16.1
CKEditor 4 vulnerabilities in versions <4.16.1
Details see:
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg ( CVE-2021-32809 )
Patch:
https://github.com/pimcore/pimcore/pull/10032
OSV
CKEditor 4 vulnerabilities in versions <4.16.1
osv·2021-08-23·CVSS 5.4
CVE-2021-37695 [MEDIUM] CKEditor 4 vulnerabilities in versions <4.16.1
CKEditor 4 vulnerabilities in versions <4.16.1
Details see:
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg ( CVE-2021-32809 )
Patch:
https://github.com/pimcore/pimcore/pull/10032
GHSA
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
ghsa·2021-08-23
CVE-2021-37695 [HIGH] CWE-79 Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
### Affected packages
The vulnerability has been discovered in [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin. All plugins with [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin dependency are affected:
* [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)
* [Link](https://ckeditor.com/cke4/addon/link)
* [Flash](https://ckeditor.com/cke4/addon/flash)
* [Iframe](https://ckeditor.com/cke4/addon/iframe)
* [Forms](https://ckeditor.com/cke4/addon/forms)
* [Page Break](https://ckeditor.com/cke4/addon/pagebreak)
### Impact
A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vuln
OSV
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
osv·2021-08-23
CVE-2021-37695 [HIGH] Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
### Affected packages
The vulnerability has been discovered in [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin. All plugins with [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin dependency are affected:
* [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)
* [Link](https://ckeditor.com/cke4/addon/link)
* [Flash](https://ckeditor.com/cke4/addon/flash)
* [Iframe](https://ckeditor.com/cke4/addon/iframe)
* [Forms](https://ckeditor.com/cke4/addon/forms)
* [Page Break](https://ckeditor.com/cke4/addon/pagebreak)
### Impact
A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vuln
OSV
CVE-2021-37695: ckeditor is an open source WYSIWYG HTML editor with rich content support
osv·2021-08-13·CVSS 5.4
CVE-2021-37695 [MEDIUM] CVE-2021-37695: ckeditor is an open source WYSIWYG HTML editor with rich content support
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Open UI (CKEditor) — CVE-2021-37695
vendor_oracle·2023-04-15·CVSS 5.4
CVE-2021-37695 [HIGH] Oracle Oracle Siebel CRM Risk Matrix: Open UI (CKEditor) — CVE-2021-37695
Oracle Oracle Siebel CRM Risk Matrix: Open UI (CKEditor) vulnerability
CVE: CVE-2021-37695
CVSS: 5.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Ubuntu
CKEditor vulnerabilities
vendor_ubuntu·2022-03-23·CVSS 6.1
CVE-2021-32809 [MEDIUM] CKEditor vulnerabilities
Title: CKEditor vulnerabilities
Summary: Several security issues were fixed in CKEditor.
USN-5340-1 fixed several vulnerabilities in CKEditor.
This update provides the fixes for CVE-2018-9861, CVE-2020-9281,
CVE-2021-32809, CVE-2021-33829 and CVE-2021-37695 for Ubuntu 16.04 ESM.
Original advisory details:
Kyaw Min Thein discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue
to execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handle
Ubuntu
CKEditor vulnerabilities
vendor_ubuntu·2022-03-22·CVSS 6.1
CVE-2020-9281 [MEDIUM] CKEditor vulnerabilities
Title: CKEditor vulnerabilities
Summary: Several security issues were fixed in CKEditor.
Kyaw Min Thein discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue
to execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 21.10. (CVE-2021-32808)
Anton Subbotin discovered that CKEditor incorrectly handled
certain inputs. A
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Application Express (CKEditor) — CVE-2021-37695
vendor_oracle·2022-01-15·CVSS 5.4
CVE-2021-37695 [HIGH] Oracle Oracle Database Server Risk Matrix: Oracle Application Express (CKEditor) — CVE-2021-37695
Oracle Oracle Database Server Risk Matrix: Oracle Application Express (CKEditor) vulnerability
CVE: CVE-2021-37695
CVSS: 5.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (CKEditor) — CVE-2021-37695
vendor_oracle·2021-10-15·CVSS 5.4
CVE-2021-37695 [HIGH] Oracle Oracle Commerce Risk Matrix: Content Acquisition System (CKEditor) — CVE-2021-37695
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (CKEditor) vulnerability
CVE: CVE-2021-37695
CVSS: 5.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Debian
CVE-2021-37695: ckeditor - ckeditor is an open source WYSIWYG HTML editor with rich content support. A pote...
vendor_debian·2021·CVSS 7.3
CVE-2021-37695 [HIGH] CVE-2021-37695: ckeditor - ckeditor is an open source WYSIWYG HTML editor with rich content support. A pote...
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
Scope: local
bookworm: resolved (fixed in 4.16.2+dfsg-1)
bullseye: open
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhchttps://lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhchttps://lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-08-13
Published