CVEvulnerability

CVE-2021-32809

5.4 MEDIUM Published 2021-08-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-08-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79, CWE-94

Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Affected configurations

• ckeditor ckeditor (>= 4.5.2 < 4.16.2) • fedoraproject fedora 33 • fedoraproject fedora 34 • fedoraproject fedora 35 • oracle application express (< 21.1.4) • oracle banking party management 2.7.0 • oracle commerce guided search 11.3.2 • oracle commerce merchandising 11.3.2 • oracle documaker 12.6.3 • oracle documaker 12.6.4 • oracle financial services analytical applications infrastructure (>= 8.0.7 <= 8.1.1) • oracle jd edwards enterpriseone tools (< 9.2.6.0) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59

Related

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References