| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor | < 4.16.2 | 4.16.2 |
| application express | < 21.1.4 | 21.1.4 |
| banking party management | = 2.7.0 | |
| commerce guided search | = 11.3.2 | |
| commerce merchandising | = 11.3.2 | |
| documaker | = 12.6.3= 12.6.4 | |
| financial services analytical applications infrastructure | = 8.0.3≥ 8.0.7, ≤ 8.1.1 | |
| financial services model management and governance | ≥ 8.0.8.0.0, ≤ 8.1.0.0.0 | |
| jd edwards enterpriseone tools | < 9.2.6.0 | 9.2.6.0 |
| peoplesoft enterprise peopletools | = 8.57= 8.58= 8.59 | |
| ckeditor4 | < 4.16.2 | 4.16.2 |
The vulnerability has been discovered in Fake Objects plugin. All plugins with Fake Objects plugin dependency are affected:
A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.
The problem has been recognized and patched. The fix will be available in version 4.16.2.
Email us at [email protected] if you have any questions or comments about this advisory.
The CKEditor 4 team would like to thank Mika Kulmala (kulmik) for recognizing and reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free