CVE-2020-27193

Description

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

CVSS breakdown

Affected products

• ckeditor / ckeditor4.15.0 – 4.15.0
• oracle / agile_product_lifecycle_management9.3.5 – 9.3.5
• oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
• oracle / application_express21.1.0.00.01
• oracle / banking_party_management2.7.0 – 2.7.0
• oracle / banking_platform2.4.0 – 2.4.0
• oracle / banking_platform2.7.0 – 2.7.0
• oracle / banking_platform2.7.1 – 2.7.1
• oracle / banking_platform2.8.0 – 2.8.0
• oracle / banking_platform2.9.0 – 2.9.0
• oracle / commerce_merchandising11.0.0 – 11.0.0
• oracle / commerce_merchandising11.1.0 – 11.1.0
• oracle / commerce_merchandising11.2.0 – 11.2.0
• oracle / commerce_merchandising11.3.0 – 11.3.0
• oracle / commerce_merchandising11.3.1 – 11.3.1
• oracle / commerce_merchandising11.3.2 – 11.3.2
• oracle / financial_services_analytical_applications_infrastructure8.0.6 – 8.0.9
• oracle / financial_services_analytical_applications_infrastructure8.1.0 – 8.1.0
• oracle / financial_services_analytical_applications_infrastructure8.1.1 – 8.1.1
• oracle / jd_edwards_enterpriseone_tools9.2.6.0
• oracle / peoplesoft_enterprise_peopletools8.56 – 8.56
• oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58

References

• MISChttps://ckeditor.com/ckeditor-4/download/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• MISChttps://ckeditor.com/cke4/release/CKEditor-4.15.1
• MISChttps://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html