CVE-2020-9281

Public PoC / Exploit (1)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (24)

ckeditor · ckeditor (up to 4.14)vulnerable

fedoraproject · fedoravulnerable

drupal · drupal (up to 8.7.12)vulnerable

drupal · drupal (up to 8.8.4)vulnerable

oracle · agile_plmvulnerable

oracle · application_express (up to 20.2)vulnerable

oracle · jd_edwards_enterpriseone_tools (up to 9.2.5.2)vulnerable

oracle · peoplesoft_enterprise_peopletoolsvulnerable

oracle · siebel_apps_-_customer_order_management (up to 21.0)vulnerable

oracle · webcenter_portalvulnerable

oracle · banking_enterprise_default_managementvulnerable

oracle · banking_enterprise_default_managmentvulnerable

References (18)

https://github.com/ckeditor/ckeditor4

ProductThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/

https://www.oracle.com/security-alerts/cpuApr2021.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

PatchVendor Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Not ApplicableThird Party Advisory

https://github.com/ckeditor/ckeditor4

ProductThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/

https://www.oracle.com/security-alerts/cpuApr2021.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

PatchVendor Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Not ApplicableThird Party Advisory