| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| ckeditor | ≥ 4.0, < 4.17.0 | 4.17.0 |
| drupal | ≥ 8.9.0, < 8.9.20≥ 9.1.0, < 9.1.14≥ 9.2.0, < 9.2.9 | 8.9.209.1.149.2.9 |
| agile product lifecycle management | = 9.3.6 | |
| application express | < 22.1 | 22.1 |
| banking apis | = 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3 | |
| banking digital experience | = 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3 | |
| commerce guided search | = 11.3.2 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 | |
| webcenter portal | = 12.2.1.3.0= 12.2.1.4.0 | |
| ckeditor4 | < 4.17.0 | 4.17.0 |
The vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.
A potential vulnerability has been discovered in CKEditor 4 Advanced Content Filter (ACF) core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.
The problem has been recognized and patched. The fix will be available in version 4.17.0.
Email us at [email protected] if you have any questions or comments about this advisory.
The CKEditor 4 team would like to thank Maurice Dauer (laytonctf) for recognizing and reporting this vulnerability.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン