CVEvulnerability

CVE-2021-26272

6.5 MEDIUM Published 2021-01-26 Modified 2026-08-25 Official page ↗
Status
Modified
Published
2021-01-26
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-829

Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Affected configurations

• ckeditor ckeditor (>= 4.0 < 4.16) • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle application express (< 21.1.0) • oracle banking party management 2.7.0 • oracle commerce merchandising (>= 11.3.0 <= 11.3.2) • oracle commerce merchandising 11.1.0 • oracle commerce merchandising 11.2.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.0.9) • oracle financial services analytical applications infrastructure 8.1.0 • oracle financial services analytical applications infrastructure 8.1.1 • oracle financial services model management and governance (>= 8.0.8.0.0 <= 8.1.0.0.0) • oracle jd edwards enterpriseone tools (< 9.2.6.0) • oracle siebel ui framework (<= 21.9) • oracle webcenter sites 12.2.1.3.0 • oracle webcenter sites 12.2.1.4.0

Related

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References