PT-2021-4279 · Unknown+3 · Ckeditor 4+3

Or Sahar · Published 2021-06-09 · Updated 2025-12-18 · CVE-2021-33829

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions 4.14.0 through 4.16.x

Description A cross-site scripting (XSS) vulnerability in the HTML Data Processor allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. This issue may allow a remote attacker to impact data integrity.

Recommendations For CKEditor 4 versions 4.14.0 through 4.16.x, update to version 4.16.1 or later to resolve the issue. As a temporary workaround, consider disabling the HTML Data Processor feature until a patch is available. Restrict access to the HTML Data Processor module to minimize the risk of exploitation. Avoid using crafted comments in the affected module until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04887

BIT-DRUPAL-2021-33829

CVE-2021-33829

DLA-2813-1

DRUPAL-CORE-2021-003

GHSA-RGX6-RJJ4-C388

USN-5340-1

USN-5340-2

Affected Products

Ckeditor 4

Debian

Linuxmint

Ubuntu

References · 36

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2021-33829.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2021-33829.yaml · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04887 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-33829 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33829 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-33829 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32808 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD · Vendor Advisory
• https://osv.dev/vulnerability/USN-5340-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32809 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33829 · Security Note
• https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser · Vendor Advisory