| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor/ckeditor | < 4.17.0 | 4.17.0 |
| ckeditor | < 4.17.0 | 4.17.0 |
| drupal | ≥ 8.9.0, < 8.9.20≥ 9.1.0, < 9.1.14≥ 9.2.0, < 9.2.9 | 8.9.209.1.149.2.9 |
| agile product lifecycle management | = 9.3.6 | |
| application express | < 22.1 | 22.1 |
| banking apis | = 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3 | |
| banking digital experience | = 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3 | |
| commerce guided search | = 11.3.2 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 | |
| webcenter portal | = 12.2.1.3.0= 12.2.1.4.0 | |
| ckeditor4 | < 4.17.0 | 4.17.0 |
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.
The problem has been recognized and patched. The fix will be available in version 4.17.0.
Email us at [email protected] if you have any questions or comments about this advisory.
The CKEditor 4 team would like to thank William Bowling (wbowling) for recognizing and reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free