CVE-2020-9281

Published: Mar 7, 2020Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Affected (24)

Products: Ckeditor: Ckeditor · Fedoraproject: Fedora · Drupal: Drupal · +1 more

Show all products

Ckeditor: Ckeditor · Fedoraproject: Fedora · Drupal: Drupal · Oracle: Agile Plm, Application Express, Jd Edwards Enterpriseone Tools, Peoplesoft Enterprise Peopletools, Siebel Apps Customer Order Management, Webcenter Portal, Banking Enterprise Default Management, Banking Enterprise Default Managment

1 product

1 product

1 product

8 products

Jd Edwards Enterpriseone Tools

Peoplesoft Enterprise Peopletools

Siebel Apps Customer Order Management

Webcenter Portal

Banking Enterprise Default Management

Banking Enterprise Default Managment

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ckeditor Ckeditor	From 4.0 to 4.14

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	From 8.7.0 to 8.7.12
Drupal Drupal	From 8.8.0 to 8.8.4

Configuration D

12 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.5
Oracle Agile Plm	Version 9.3.6
Oracle Application Express	Before 20.2
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.5.2
Oracle Peoplesoft Enterprise Peopletools	All versions
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Siebel Apps Customer Order Management	Before 21.0
Oracle Webcenter Portal	Version 11.1.1.9.0
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 12.2.1.4.0

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Enterprise Default Management	Version 2.10.0
Oracle Banking Enterprise Default Management	Version 2.12.0
Oracle Banking Enterprise Default Management	Version 2.6.2
Oracle Banking Enterprise Default Management	Version 2.7.0
Oracle Banking Enterprise Default Management	Version 2.7.1
Oracle Banking Enterprise Default Managment	From 2.3.0 to 2.4.0