NetSight
IP …
high7.6

CVE-2021-32808

ckeditor is an open source WYSIWYG HTML editor with rich content support.

Impact

ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Affected products

VendorProductAffected versions
CkeditorCkeditor
from 4.13.0 before 4.16.2
FedoraprojectFedora
Versions 33, 34, 35
OracleApplication Express
before 21.1.4
OracleBanking Party Management
Version 2.7.0
OracleCommerce Guided Search
Version 11.3.2
OracleCommerce Merchandising
Version 11.3.2
OracleDocumaker
Versions 12.6.3, 12.6.4
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.7 through 8.1.1
OracleFinancial Services Model Management And Governance
Versions 8.0.8.0.0, 8.1.0.0.0
OracleJd Edwards Enterpriseone Tools
through 9.2.6.0
OraclePeoplesoft Enterprise Peopletools
Versions 8.57, 8.58, 8.59
OracleSiebel Ui Framework
through 21.9

Weakness classification

CWE-79

References