CVE-2021-33829

Katalog CVE

CVSS 6.1 · Medium EPSS 3,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ckeditor, fedoraproject fedora +2 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

Rincian

Terbit di NVD

9 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-p... patch · release notes · advisory vendor
• https://www.drupal.org/sa-core-2021-003 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KC...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKC...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP...