CVE-2021-41164

Katalog CVE

CVSS 5.4 · Medium EPSS 1,3%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ckeditor, drupal +8 lainnya. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Rincian

Terbit di NVD

17 November 2021

Terakhir diubah

25 Agustus 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj advisory pihak ketiga
• https://www.drupal.org/sa-core-2021-011 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QU...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKK...
• https://www.oracle.com/security-alerts/cpujul2022.html not applicable