| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 8.0.0, < 9.2.15≥ 9.3.0, < 9.3.8 | 9.2.159.3.8 |
| ckeditor | ≥ 4.0, < 4.18.0 | 4.18.0 |
| drupal | ≥ 8.0.0, < 9.2.15≥ 9.3.0, < 9.3.8 | 9.2.159.3.8 |
| application express | < 22.1.1 | 22.1.1 |
| commerce merchandising | = 11.3.2 | |
| financial services analytical applications infrastructure | = 8.1.1.0= 8.1.2.0= 8.1.2.1≥ 8.0.7.0.0, ≤ 8.1.0.0.0 | |
| financial services behavior detection platform | = 8.0.7.0= 8.0.8.0≥ 8.1.1.0, ≤ 8.1.2.1 | |
| financial services trade-based anti money laundering | = 8.0.7= 8.0.8 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 | |
| ckeditor4 | < 4.18.0 | 4.18.0 |
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.18.0.
The problem has been recognized and patched. The fix will be available in version 4.18.0.
Email us at [email protected] if you have any questions or comments about this advisory.
The CKEditor 4 team would like to thank GHSL team member Kevin Backhouse (@kevinbackhouse) for recognizing and reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free