CVE-2021-32809mediumCWE-94

CVE-2021-32809: falha de média gravidade em ckeditor4

Arbitrary HTML injection vulnerability in ckeditor

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ckeditor4+ Monitorar ckeditor

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.6epss 1.2%
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
ckeditor · ckeditor4
CVEs relacionadas — ckeditor4

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24729MEDIUMRegular expression Denial of Service in dialog pluginEPSS 2.5%CVE-2024-24816MEDIUMCross-site scripting (XSS) vulnerability in samples with enabled the preview featureEPSS 1.7%CVE-2021-41165HIGHHTML comments vulnerability allowing to execute JavaScript codeEPSS 1.6%CVE-2021-41164HIGHAdvanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTMLEPSS 1.3%CVE-2021-37695HIGHExecution of JavaScript code using malformed HTML in ckeditorEPSS 1.3%CVE-2022-24728MEDIUMCross-site Scripting in CKEditor4EPSS 1.2%