PT-2021-6455 · Unknown+3 · Ckeditor 4+3

Published 2021-07-19 · Updated 2022-03-22 · CVE-2021-32808

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions 4.13.0 through 4.16.1

Description A vulnerability has been discovered in the clipboard Widget plugin when used alongside the undo feature in CKEditor 4. This issue allows a user to abuse undo functionality using malformed widget HTML, potentially resulting in the execution of JavaScript code. The problem affects all users of the CKEditor 4 plugins at version 4.13.0 and later.

Recommendations For CKEditor 4 versions 4.13.0 through 4.16.1, update to version 4.16.2 to resolve the issue. As a temporary workaround, consider disabling the undo feature when using the clipboard Widget plugin until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-01665

CVE-2021-32808

GHSA-6226-H7FF-CH6C

USN-5340-1

Affected Products

Ckeditor 4

Debian

Linuxmint

Ubuntu

References · 30

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32808 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5340-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01665 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://ubuntu.com/security/CVE-2021-32808 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32808 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32809 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33829 · Vendor Advisory