Published: 17/11/2021 Updated: 07/11/2023

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

CVSS v3 Base Score: 5.4 | Impact Score: 2.7 | Exploitability Score: 2.3

VMScore: 312

Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ckeditor ckeditor
drupal drupal
oracle banking digital experience 19.1
oracle banking digital experience 19.2
oracle banking digital experience 20.1
oracle banking digital experience 21.1
oracle banking apis
oracle banking apis 19.1
oracle banking apis 19.2
oracle banking apis 20.1
oracle banking apis 21.1
oracle banking digital experience
oracle webcenter portal 12.2.1.3.0
oracle agile plm 9.3.6
oracle peoplesoft enterprise peopletools 8.58
oracle webcenter portal 12.2.1.4.0
oracle commerce guided search 11.3.2
oracle peoplesoft enterprise peopletools 8.59
oracle application express
fedoraproject fedora 36
fedoraproject fedora 37

Debian Bug report logs - #999909 ckeditor: CVE-2021-41164 CVE-2021-41165 Package: src:ckeditor; Maintainer for src:ckeditor is Debian Javascript Maintainers <pkg-javascript-devel@listsaliothdebianorg>; Reported by: Neil Williams <codehelp@debianorg> Date: Thu, 18 Nov 2021 10:45:04 UTC Severity: important Tags: se ...

In CKEditor4 before version 4170, as used by Drupal beforer version 929, a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4 The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code In Drupal, an ...

CWE-79 https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 https://www.drupal.org/sa-core-2021-011 https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999909 https://nvd.nist.gov https://security.archlinux.org/CVE-2021-41164

CVE-2021-41164

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect