CVE-2021-32808

ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.

• ckeditor ckeditor (>= 4.13.0 < 4.16.2) • fedoraproject fedora 33 • fedoraproject fedora 34 • fedoraproject fedora 35 • oracle application express (< 21.1.4) • oracle banking party management 2.7.0 • oracle commerce guided search 11.3.2 • oracle commerce merchandising 11.3.2 • oracle documaker 12.6.3 • oracle documaker 12.6.4 • oracle financial services analytical applications infrastructure (>= 8.0.7 <= 8.1.1) • oracle financial services model management and governance 8.0.8.0.0 • oracle financial services model management and governance 8.1.0.0.0 • oracle jd edwards enterpriseone tools (<= 9.2.6.0) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • oracle siebel ui framework (<= 21.9) • oracle webcenter sites 12.2.1.3.0 • oracle webcenter sites 12.2.1.4.0