CVE-2021-41165highCWE-79

CVE-2021-41165: falha de alta gravidade em ckeditor4

HTML comments vulnerability allowing to execute JavaScript code

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ckeditor4+ Monitorar ckeditor

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 1.6%
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Produtos afetados
ckeditor · ckeditor4
CVEs relacionadas — ckeditor4

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24729MEDIUMRegular expression Denial of Service in dialog pluginEPSS 2.5%CVE-2024-24816MEDIUMCross-site scripting (XSS) vulnerability in samples with enabled the preview featureEPSS 1.7%CVE-2021-41164HIGHAdvanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTMLEPSS 1.3%CVE-2021-37695HIGHExecution of JavaScript code using malformed HTML in ckeditorEPSS 1.3%CVE-2022-24728MEDIUMCross-site Scripting in CKEditor4EPSS 1.2%CVE-2021-32808HIGHCross-site scripting in ckeditor via abuse of undo functionalityEPSS 1.2%