PT-2021-6524 · Ckeditor+3 · Clipboard+10

Published 2021-08-12 · Updated 2026-05-22 · CVE-2021-32809

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor versions 4.5.2 through 4.16.1 CKEditor 4 plugins with clipboard plugin dependency versions 4.5.2 and later, including:

• clipboard
• pastetext
• pastetools
• widget
• uploadwidget
• autolink
• tableselection

Description The issue is related to incorrect code generation management in the CKEditor Clipboard plugin, allowing a remote attacker to impact data integrity by injecting arbitrary HTML into the editor using malformed HTML in the paste functionality.

Recommendations For CKEditor versions 4.5.2 through 4.16.1, update to version 4.16.2 to resolve the issue. For CKEditor 4 plugins with clipboard plugin dependency, update the plugins to versions compatible with CKEditor 4.16.2. As a temporary workaround, consider disabling the paste functionality using the clipboard plugin until a patch is available. Restrict access to the clipboard plugin to minimize the risk of exploitation.

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

BDU:2022-01784

CVE-2021-32809

GHSA-7889-RM5J-HPGG

USN-5340-1

USN-5340-2

Affected Products

Ckeditor

Debian

Linuxmint

Ubuntu

Autolink

Clipboard

Pastetext

Pastetools

Tableselection

Uploadwidget

Widget

References · 32

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32809 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5340-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32809 · Security Note
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://bdu.fstec.ru/vul/2022-01784 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-9861 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37695 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32809 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33829 · Vendor Advisory