CVEvulnerability

CVE-2021-37695

5.4 MEDIUM Published 2021-08-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Affected configurations

• ckeditor ckeditor (< 4.16.2) • debian debian linux 9.0 • fedoraproject fedora 33 • fedoraproject fedora 34 • fedoraproject fedora 35 • oracle application express (< 21.1.4) • oracle banking party management 2.7.0 • oracle commerce guided search 11.3.2 • oracle commerce merchandising 11.3.2 • oracle documaker 12.6.3 • oracle documaker 12.6.4 • oracle financial services analytical applications infrastructure (>= 8.0.7 <= 8.1.1) • oracle financial services analytical applications infrastructure 8.0.3 • oracle financial services model management and governance (>= 8.0.8.0.0 <= 8.1.0.0.0) • oracle jd edwards enterpriseone tools (< 9.2.6.0) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References