| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor | ≥ 4.0, < 4.18.0 | 4.18.0 |
| drupal | ≥ 8.0.0, < 9.2.15≥ 9.3.0, < 9.3.8 | 9.2.159.3.8 |
| application express | < 22.1.1 | 22.1.1 |
| commerce merchandising | = 11.3.2 | |
| financial services analytical applications infrastructure | = 8.1.1.0= 8.1.2.0= 8.1.2.1≥ 8.0.7.0.0, ≤ 8.1.0.0.0 | |
| financial services behavior detection platform | = 8.0.7.0= 8.0.8.0≥ 8.1.1.0, ≤ 8.1.2.1 | |
| financial services trade-based anti money laundering | = 8.0.7= 8.0.8 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 |
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free