GitHub Advisoryadvisory · npm, Packagist

GHSA-rgx6-rjj4-c388 ckeditor4 vulnerable to cross-site scripting

MEDIUM Published 2021-06-21 Modified 2024-02-08 Official page ↗
Aliases
CVE-2021-33829
Ecosystem
npm, Packagist
Packages
ckeditor4, drupal/core, drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-06-14

Affected packages

• npm ckeditor4: >= 4.14.0, < 4.16.1 → fixed in 4.16.1 • Packagist drupal/core: >= 7.0.0, < 7.80 → fixed in 7.80 • Packagist drupal/core: >= 8.0.0, < 8.9.16 → fixed in 8.9.16 • Packagist drupal/core: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • Packagist drupal/core: >= 9.1.0, < 9.1.9 → fixed in 9.1.9 • Packagist drupal/drupal: >= 7.0.0, < 7.80 → fixed in 7.80 • Packagist drupal/drupal: >= 8.0.0, < 8.9.16 → fixed in 8.9.16 • Packagist drupal/drupal: >= 9.0.0, < 9.0.14 → fixed in 9.0.14 • Packagist drupal/drupal: >= 9.1.0, < 9.1.9 → fixed in 9.1.9

Description

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because `--!>` is mishandled.

Related

Alias · CVE (1)

  • CVE-2021-33829 A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References