CVE-2021-26271

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

1.96%

Published

Jan 26, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-829

Affected Products (11)

ckeditor · ckeditor (up to 4.16)vulnerable

oracle · agile_plmvulnerable

oracle · application_express (up to 21.1.0)vulnerable

oracle · financial_services_analytical_applications_infrastructurevulnerable

oracle · jd_edwards_enterpriseone_tools (up to 9.2.6.0)vulnerable

oracle · siebel_ui_framework (up to 21.9)vulnerable

oracle · webcenter_sitesvulnerable

References (8)

https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first

Vendor Advisory

https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416

Release NotesThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

PatchThird Party Advisory

https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first

Vendor Advisory

https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416

Release NotesThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

PatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs