PT-2021-6875 · Unknown+1 · Ckeditor 4+1

Published 2021-11-17 · Updated 2024-03-06 · CVE-2021-41164

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions prior to 4.17.0

Description The issue is related to the Advanced Content Filter (ACF) module in CKEditor 4, which fails to properly protect the structure of web pages. This allows a remote attacker to bypass existing access restriction policies for HTML elements. The vulnerability enables the injection of malformed HTML, bypassing content sanitization, and could result in the execution of JavaScript code.

Recommendations For versions prior to 4.17.0, update to version 4.17.0 to resolve the issue. As a temporary workaround, consider restricting the use of the Advanced Content Filter (ACF) module until the patch is applied. Avoid using the CKEditor 4 at versions less than 4.17.0 to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-02391

BIT-DRUPAL-2021-41164

CVE-2021-41164

GHSA-PVMX-G8H5-CPRJ

Affected Products

Ckeditor 4

Debian

References · 22

• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-41164 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02391 · Security Note
• https://osv.dev/vulnerability/BIT-drupal-2021-41164 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41164 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/GHSA-pvmx-g8h5-cprj · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41164 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-41164 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41164 · Vendor Advisory