CVE-2021-26272

Published: Jan 26, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Affected (16)

Products: Ckeditor: Ckeditor · Oracle: Agile Plm, Application Express, Banking Party Management, Commerce Merchandising, Financial Services Analytical Applications Infrastructure, Financial Services Model Management And Governance, Jd Edwards Enterpriseone Tools, Siebel Ui Framework, Webcenter Sites

1 product

9 products

Banking Party Management

Commerce Merchandising

Financial Services Analytical Applications Infrastructure

Financial Services Model Management And Governance

Jd Edwards Enterpriseone Tools

Siebel Ui Framework

Webcenter Sites

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ckeditor Ckeditor	From 4.0 to 4.16

Configuration B

15 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.5
Oracle Agile Plm	Version 9.3.6
Oracle Application Express	Before 21.1.0
Oracle Banking Party Management	Version 2.7.0
Oracle Commerce Merchandising	From 11.3.0 to 11.3.2
Oracle Commerce Merchandising	Version 11.1.0
Oracle Commerce Merchandising	Version 11.2.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6 to 8.0.9
Oracle Financial Services Analytical Applications Infrastructure	Version 8.1.0
Oracle Financial Services Analytical Applications Infrastructure	Version 8.1.1
Oracle Financial Services Model Management And Governance	From 8.0.8.0.0 to 8.1.0.0.0
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.6.0
Oracle Siebel Ui Framework	Up to 21.9
Oracle Webcenter Sites	Version 12.2.1.3.0
Oracle Webcenter Sites	Version 12.2.1.4.0