CVE-2021-26272

Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

CVSS breakdown

Affected products

• ckeditor / ckeditor4.0 – 4.16
• oracle / agile_product_lifecycle_management9.3.5 – 9.3.5
• oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
• oracle / application_express21.1.0
• oracle / banking_party_management2.7.0 – 2.7.0
• oracle / commerce_merchandising11.3.0 – 11.3.2
• oracle / commerce_merchandising11.1.0 – 11.1.0
• oracle / commerce_merchandising11.2.0 – 11.2.0
• oracle / financial_services_analytical_applications_infrastructure8.0.6 – 8.0.9
• oracle / financial_services_analytical_applications_infrastructure8.1.0 – 8.1.0
• oracle / financial_services_analytical_applications_infrastructure8.1.1 – 8.1.1
• oracle / financial_services_model_management_and_governance8.0.8.0.0 – 8.1.0.0.0
• oracle / jd_edwards_enterpriseone_tools9.2.6.0
• oracle / Siebel UI Framework21.9
• oracle / webcenter_sites12.2.1.3.0 – 12.2.1.3.0
• oracle / webcenter_sites12.2.1.4.0 – 12.2.1.4.0

References

• MISChttps://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• MISChttps://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html