| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor | ≥ 4.5.2, < 4.16.2 | 4.16.2 |
| application express | < 21.1.4 | 21.1.4 |
| banking party management | = 2.7.0 | |
| commerce guided search | = 11.3.2 | |
| commerce merchandising | = 11.3.2 | |
| documaker | = 12.6.3= 12.6.4 | |
| financial services analytical applications infrastructure | ≥ 8.0.7, ≤ 8.1.1 | |
| jd edwards enterpriseone tools |
The vulnerability has been discovered in clipboard plugin. All plugins with clipboard plugin dependency are affected:
A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2.
The problem has been recognized and patched. The fix will be available in version 4.16.2.
Email us at [email protected] if you have any questions or comments about this advisory.
The CKEditor 4 team would like to thank Anton Subbotin (skavans) for recognizing and reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free< 9.2.6.0 |
9.2.6.0 |
| peoplesoft enterprise peopletools | = 8.57= 8.58= 8.59 |
| ckeditor4 | ≥ 4.5.2, < 4.16.2 | 4.16.2 |