CVEvulnerability

CVE-2021-26271

6.5 MEDIUM Published 2021-01-26 Modified 2026-08-25 Official page ↗
Status
Modified
Published
2021-01-26
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-829

Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

Affected configurations

• ckeditor ckeditor (>= 4.0 < 4.16) • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle application express (< 21.1.0) • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.0.9) • oracle financial services analytical applications infrastructure 8.1.0 • oracle financial services analytical applications infrastructure 8.1.1 • oracle jd edwards enterpriseone tools (< 9.2.6.0) • oracle siebel ui framework (< 21.9) • oracle webcenter sites 12.2.1.3.0 • oracle webcenter sites 12.2.1.4.0

Related

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References