CVE-2021-41164

CWE-79 — Cross-site Scripting (XSS)7 documents6 sources
Severity
5.4MEDIUM
EPSS
0.1%
top 77.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Ckeditor Ckeditor4Ckeditor CkeditorDrupal Drupal+8 more
Timeline
PublishedNov 17

Description

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:LExploitability: 2.3 | Impact: 5.3

Affected Packages12 packages

▶npmckeditor4< 4.17.0
▶CVEListV5ckeditor/ckeditor4< 4.17.0
▶NVDckeditor/ckeditor4.0 — 4.17.0
▶Debianckeditor< 4.19.0+dfsg-1
▶NVDdrupal/drupal8.9.0 — 8.9.20+2

Also affects: Fedora 36, 37

Patches

Patch: github.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
GHSA
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML↗2021-11-17
▶
OSV
CVE-2021-41164: CKEditor4 is an open source WYSIWYG HTML editor↗2021-11-17
▶
CVEList
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML↗2021-11-17
▶
OSV
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML↗2021-11-17
▶

📋Vendor Advisories

2
Drupal
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2021-011↗2021-11-17
▶
Debian
CVE-2021-41164: ckeditor - CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerab...↗2021
▶