CVE-2021-41165

Опубликовано: 17 нояб. 2021

Источник: nvd

CVSS3: 8.2

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Ссылки

https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417
Third Party Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2
Third Party Advisory
https://www.drupal.org/sa-core-2021-011
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Not Applicable
https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417
Third Party Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2
Third Party Advisory
https://www.drupal.org/sa-core-2021-011
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Not Applicable

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*

Версия до 4.17.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 8.9.0 (включая) до 8.9.20 (исключая)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 9.1.0 (включая) до 9.1.14 (исключая)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 9.2.0 (включая) до 9.2.9 (исключая)

Конфигурация 3

Одно из

cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*

Версия до 22.1 (исключая)

cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*

Версия от 18.1 (включая) до 18.3 (включая)

cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*

Версия от 18.1 (включая) до 18.3 (включая)

cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00123

Низкий

8.2 High

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2021-41165

CVSS3: 8.2

ubuntu

больше 3 лет назад

CVE-2021-41165

CVSS3: 8.2

debian

больше 3 лет назад

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a ...

GHSA-7h26-63m7-qhf2

CVSS3: 8.2

github

больше 3 лет назад

HTML comments vulnerability allowing to execute JavaScript code

BDU:2022-02008

CVSS3: 8.2

fstec

больше 3 лет назад

Уязвимость модуля обработки HTML-страниц WYSIWYG-редактора CKEditor, позволяющая нарушителю осуществлять межсайтовые сценарные атаки

EPSS

Процентиль: 33%

0.00123

Низкий

8.2 High

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79