Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- ckeditor / ckeditor4.0 – 4.14
- Drupal / Drupal8.7.0 – 8.7.12
- fedoraproject / fedora31 – 31
- fedoraproject / fedora32 – 32
- fedoraproject / fedora30 – 30
- oracle / agile_product_lifecycle_management9.3.5 – 9.3.5
- oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
- oracle / application_express20.2
- oracle / banking_enterprise_default_management2.7.0 – 2.7.0
- oracle / banking_enterprise_default_management2.12.0 – 2.12.0
- oracle / banking_enterprise_default_management2.10.0 – 2.10.0
- oracle / banking_enterprise_default_management2.7.1 – 2.7.1
- oracle / banking_enterprise_default_management2.6.2 – 2.6.2
- oracle / banking_enterprise_default_managment2.3.0 – 2.4.0
- oracle / jd_edwards_enterpriseone_tools9.2.5.2
- oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
- oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
- oracle / peoplesoft_enterprise_peopletools8.56 – 8.56
- oracle / peoplesoft_enterprise_peopletools
- oracle / siebel_apps_-_customer_order_management21.0
- oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
- oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0
- oracle / webcenter_portal11.1.1.9.0 – 11.1.1.9.0
References
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
- MISChttps://github.com/ckeditor/ckeditor4
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2021.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
Updated 8m ago · 8 sources