ZeroHour

CVE-2021-32809

CVSS 3.1
5.4 medium
EPSS
1%p66
Published
()
Modified
Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Vendors
ckeditorfedoraprojectoracle
Products
ckeditor, fedora, application express, banking party management, commerce guided search, commerce merchandising, documaker, financial services analytical applications infrastructure, jd edwards enterpriseone tools, peoplesoft enterprise peopletools
Weakness
CWE-94, CWE-79
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In the news

No ingested article mentions this CVE yet.