← Back

CVE-2021-41165

nvd nist
Published: Nov 17, 2021Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD

Description

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Affected (21)

Ckeditor
1 product
Ckeditor
Drupal
1 product
Drupal
Oracle
7 products
Agile Product Lifecycle Management
Application Express
Banking Apis
Banking Digital Experience
Commerce Guided Search
Peoplesoft Enterprise Peopletools
Webcenter Portal
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Ckeditor
Before 4.17.0
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Drupal
Drupal
From 8.9.0 to 8.9.20
Drupal
From 9.1.0 to 9.1.14
Drupal
From 9.2.0 to 9.2.9
Configuration C
17 vulnerable
Vulnerable SoftwareAffected Versions
Agile Product Lifecycle Management
Version 9.3.6
Application Express
Before 22.1
Oracle
Banking Apis
From 18.1 to 18.3
Banking Apis
Version 19.1
Banking Apis
Version 19.2
Banking Apis
Version 20.1
Banking Apis
Version 21.1
Oracle
Banking Digital Experience
From 18.1 to 18.3
Banking Digital Experience
Version 19.1
Banking Digital Experience
Version 19.2
Banking Digital Experience
Version 20.1
Banking Digital Experience
Version 21.1
Commerce Guided Search
Version 11.3.2
Oracle
Peoplesoft Enterprise Peopletools
Version 8.58
Peoplesoft Enterprise Peopletools
Version 8.59
Oracle
Webcenter Portal
Version 12.2.1.3.0
Webcenter Portal
Version 12.2.1.4.0

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (12)

Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable

Timeline

No history available yet.