CVEvulnerability

CVE-2020-9281

6.1 MEDIUM Published 2020-03-07 Modified 2026-08-25 Official page ↗
Status
Modified
Published
2020-03-07
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Affected configurations

• ckeditor ckeditor (>= 4.0 < 4.14) • fedoraproject fedora 30 • fedoraproject fedora 31 • fedoraproject fedora 32 • drupal drupal (>= 8.7.0 < 8.7.12) • drupal drupal (>= 8.8.0 < 8.8.4) • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle application express (< 20.2) • oracle jd edwards enterpriseone tools (< 9.2.5.2) • oracle peoplesoft enterprise peopletools • oracle peoplesoft enterprise peopletools 8.56 • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle siebel apps - customer order management (< 21.0) • oracle webcenter portal 11.1.1.9.0 • oracle webcenter portal 12.2.1.3.0 • oracle webcenter portal 12.2.1.4.0 • oracle banking enterprise default management 2.6.2 • oracle banking enterprise default management 2.7.0 • oracle banking enterprise default management 2.7.1 • oracle banking enterprise default management 2.10.0 • oracle banking enterprise default management 2.12.0 • oracle banking enterprise default managment (>= 2.3.0 <= 2.4.0)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References