PT-2021-6879 · Unknown · Ckeditor 4

Published 2021-01-26 · Updated 2022-03-01 · CVE-2021-26272

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CKEditor 4 versions prior to 4.16

Description The issue is related to the Autolink plugin in CKEditor 4, where it is possible to execute a ReDoS-type attack by persuading a victim to paste crafted URL-like text into the editor and then press Enter or Space. This could allow a remote attacker to cause a denial of service.

Recommendations For CKEditor 4 versions prior to 4.16, update to version 4.16 or later to resolve the issue. As a temporary workaround, consider disabling the Autolink plugin until a patch is available. Restrict access to the editor to minimize the risk of exploitation. Avoid using the Autolink feature in the affected versions until the issue is resolved.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

BDU:2022-02396

CVE-2021-26272

GHSA-WPVM-WQR4-P7CW

Affected Products

Ckeditor 4

References · 18

• https://osv.dev/vulnerability/GHSA-wpvm-wqr4-p7cw · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26272 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26272 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26272 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-26272 · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://bdu.fstec.ru/vul/2022-02396 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26272 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26272 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26272 · Security Note
• https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first · Vendor Advisory
• https://github.com/ckeditor/ckeditor4 · Note
• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416 · Note
• https://t.me/cibsecurity/22683 · Telegram Post