p PatchFirst

CVE-2021-32809

CVE-2021-32809 · Arbitrary HTML injection vulnerability in ckeditor

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

CVSS 4.6 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • ckeditor4

    Versions
    • >= 4.5.2, < 4.16.2: Affected

    No fix published

  • ckeditor Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.16.2+dfsg-1

    Update to 4.16.2+dfsg-1

  • ckeditor4 npm

    Affected ranges
    • SEMVER: ≥ 4.5.2, < 4.16.2

    Update to 4.16.2

  • ckeditor Ubuntu:Pro:16.04:LTS

    Versions
    • 4.4.4+dfsg1-3
    • 4.5.6+dfsg-1
    • 4.5.7+dfsg-1
    • 4.5.7+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 4.5.7+dfsg-2ubuntu0.16.04.1~esm1

    Update to 4.5.7+dfsg-2ubuntu0.16.04.1~esm1

  • ckeditor Ubuntu:18.04:LTS

    Versions
    • 4.5.7+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 4.5.7+dfsg-2ubuntu0.18.04.1

    Update to 4.5.7+dfsg-2ubuntu0.18.04.1

  • ckeditor Ubuntu:20.04:LTS

    Versions
    • 4.11.1+dfsg-1
    • 4.12.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 4.12.1+dfsg-1ubuntu0.1

    Update to 4.12.1+dfsg-1ubuntu0.1

Original sources

Check your server →