CVE-2020-27193

Published: Nov 12, 2020Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

Affected (23)

Products: Ckeditor: Ckeditor · Oracle: Agile Plm, Application Express, Banking Party Management, Banking Platform, Commerce Merchandising, Financial Services Analytical Applications Infrastructure, Jd Edwards Enterpriseone Tools, Peoplesoft Enterprise Peopletools

1 product

8 products

Banking Party Management

Banking Platform

Commerce Merchandising

Financial Services Analytical Applications Infrastructure

Jd Edwards Enterpriseone Tools

Peoplesoft Enterprise Peopletools

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ckeditor Ckeditor	Version 4.15.0

Configuration B

22 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.5
Oracle Agile Plm	Version 9.3.6
Oracle Application Express	Before 21.1.0.00.01
Oracle Banking Party Management	Version 2.7.0
Oracle Banking Platform	Version 2.4.0
Oracle Banking Platform	Version 2.7.0
Oracle Banking Platform	Version 2.7.1
Oracle Banking Platform	Version 2.8.0
Oracle Banking Platform	Version 2.9.0
Oracle Commerce Merchandising	Version 11.0.0
Oracle Commerce Merchandising	Version 11.1.0
Oracle Commerce Merchandising	Version 11.2.0
Oracle Commerce Merchandising	Version 11.3.0
Oracle Commerce Merchandising	Version 11.3.1
Oracle Commerce Merchandising	Version 11.3.2
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6 to 8.0.9
Oracle Financial Services Analytical Applications Infrastructure	Version 8.1.0
Oracle Financial Services Analytical Applications Infrastructure	Version 8.1.1
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.6.0
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58