PT-2021-6670 · Unknown+1 · Ckeditor 4+1

Published 2021-11-17 · Updated 2024-03-06 · CVE-2021-41165

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions prior to 4.17.0

Description A vulnerability has been discovered in the core HTML processing module of CKEditor 4, which may affect all plugins used by the editor. This issue allows an attacker to inject malformed comments HTML, bypassing content sanitization, and potentially executing JavaScript code. The problem affects all users using CKEditor 4 at version prior to 4.17.0.

Recommendations For CKEditor 4 versions prior to 4.17.0, update to version 4.17.0 to resolve the issue. As a temporary workaround, consider disabling the HTML processing core module until a patch is available. Restrict access to the editor's plugins to minimize the risk of exploitation. Avoid using the editor until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-02008

BIT-DRUPAL-2021-41165

CVE-2021-41165

GHSA-7H26-63M7-QHF2

Affected Products

Ckeditor 4

Debian

References · 17

• https://osv.dev/vulnerability/GHSA-7h26-63m7-qhf2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41165 · Security Note
• https://ubuntu.com/security/CVE-2021-41165 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41165 · Security Note
• https://bdu.fstec.ru/vul/2022-02008 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-41165 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41165 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2021-41165 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41165 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41165 · Vendor Advisory
• https://github.com/ckeditor/ckeditor4 · Note
• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 · Note
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2 · Note