CVE-2021-26272
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD
Description
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Affected (16)
Products: Ckeditor: Ckeditor · Oracle: Agile Product Lifecycle Management, Application Express, Banking Party Management, Commerce Merchandising, Financial Services Analytical Applications Infrastructure, Financial Services Model Management And Governance, Jd Edwards Enterpriseone Tools, Siebel Ui Framework, Webcenter Sites
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 9.3.5 | |
| Before 21.1.0 | |
| Version 2.7.0 | |
| From 11.3.0 to 11.3.2 | |
| From 8.0.6 to 8.0.9 | |
| From 8.0.8.0.0 to 8.1.0.0.0 | |
| Before 9.2.6.0 | |
| Up to 21.9 | |
| Version 12.2.1.3.0 |
References (10)
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Release NotesThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Not ApplicableThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not ApplicableThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Timeline
No history available yet.