| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor | ≥ 4.13.0, < 4.16.2 | 4.16.2 |
| application express | < 21.1.4 | 21.1.4 |
| banking party management | = 2.7.0 | |
| commerce guided search | = 11.3.2 | |
| commerce merchandising | = 11.3.2 | |
| documaker | = 12.6.3= 12.6.4 | |
| financial services analytical applications infrastructure | ≥ 8.0.7, ≤ 8.1.1 | |
| financial services model management and governance | = 8.0.8.0.0= 8.1.0.0.0 | |
| jd edwards enterpriseone tools | ≤ 9.2.6.0 | |
| peoplesoft enterprise peopletools | = 8.57= 8.58= 8.59 | |
| siebel ui framework | ≤ 21.9 | |
| webcenter sites | = 12.2.1.3.0= 12.2.1.4.0 | |
| ckeditor4 | ≥ 4.13.0, < 4.16.2 | 4.16.2 |
The vulnerability has been discovered in Widget plugin if used alongside Undo feature.
A potential vulnerability has been discovered in CKEditor 4 Widget package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0.
The problem has been recognized and patched. The fix will be available in version 4.16.2.
Email us at [email protected] if you have any questions or comments about this advisory.
The CKEditor 4 team would like to thank Anton Subbotin (skavans) for recognizing and reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free