CVE-2021-37695highCWE-79

CVE-2021-37695: falha de alta gravidade em ckeditor4

Execution of JavaScript code using malformed HTML in ckeditor

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ckeditor4+ Monitorar ckeditor

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 1.3%
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
ckeditor · ckeditor4
CVEs relacionadas — ckeditor4

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24729MEDIUMRegular expression Denial of Service in dialog pluginEPSS 2.5%CVE-2024-24816MEDIUMCross-site scripting (XSS) vulnerability in samples with enabled the preview featureEPSS 1.7%CVE-2021-41165HIGHHTML comments vulnerability allowing to execute JavaScript codeEPSS 1.6%CVE-2021-41164HIGHAdvanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTMLEPSS 1.3%CVE-2022-24728MEDIUMCross-site Scripting in CKEditor4EPSS 1.2%CVE-2021-32808HIGHCross-site scripting in ckeditor via abuse of undo functionalityEPSS 1.2%