p PatchFirst

CVE-2021-32808

CVE-2021-32808 · Cross-site scripting in ckeditor via abuse of undo functionality

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.

CVSS 7.6 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • ckeditor4

    Versions
    • >= 4.13.0, < 4.16.2: Affected

    No fix published

  • ckeditor Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.16.2+dfsg-1

    Update to 4.16.2+dfsg-1

  • ckeditor4 npm

    Affected ranges
    • SEMVER: ≥ 4.13.0, < 4.16.2

    Update to 4.16.2

Original sources

Check your server →