NetSight
IP …
medium6.1

CVE-2020-9281

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script throu…

Impact

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Affected products

VendorProductAffected versions
CkeditorCkeditor
from 4.0 before 4.14
FedoraprojectFedora
Versions 30, 31, 32
DrupalDrupal
from 8.7.0 before 8.7.12
from 8.8.0 before 8.8.4
OracleAgile Product Lifecycle Management
Versions 9.3.5, 9.3.6
OracleApplication Express
before 20.2
OracleJd Edwards Enterpriseone Tools
before 9.2.5.2
OraclePeoplesoft Enterprise Peopletools
All versions
Versions 8.56, 8.57, 8.58
OracleSiebel Apps - Customer Order Management
before 21.0
OracleWebcenter Portal
Versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
OracleBanking Enterprise Default Management
Versions 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
OracleBanking Enterprise Default Managment
from 2.3.0 through 2.4.0

Weakness classification

CWE-79

References