VulnerabilityModified
CVE-2021-26272
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
MEDIUM 6.5EPSS 2.22%
Does this matter?
Lower severity and a low EPSS score (2.22%). Track it; it rarely justifies an emergency change on its own.
Description
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 2.22% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-829
- Affected
- ckeditor/ckeditor · oracle/agile product lifecycle management · oracle/application express · oracle/banking party management · oracle/commerce merchandising · oracle/financial services analytical applications infrastructure · oracle/financial services model management and governance · oracle/jd edwards enterpriseone tools · oracle/siebel ui framework · oracle/webcenter sites
- Source
- cve@mitre.org
References
- https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-firstVendor Advisory
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416Release Notes, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlNot Applicable, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-firstVendor Advisory
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416Release Notes, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlNot Applicable, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.