CVE-2021-26271
First published: Tue Jan 26 2021(Updated: )
CKEditor is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Advanced Tab for Dialogs plugin. By persuading a victim to paste specially-crafted text into the Styles input of specific dialogs, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ckeditor Ckeditor | >=4.0<4.16 | |
| Oracle Agile PLM | =9.3.5 | |
| Oracle Agile PLM | =9.3.6 | |
| Oracle Application Express | <21.1.0 | |
| Oracle Financial Services Analytical Applications Infrastructure | >=8.0.6<=8.0.9 | |
| Oracle Financial Services Analytical Applications Infrastructure | =8.1.0 | |
| Oracle Financial Services Analytical Applications Infrastructure | =8.1.1 | |
| Oracle Jd Edwards Enterpriseone Tools | <9.2.6.0 | |
| Oracle Siebel Ui Framework | <21.9 | |
| Oracle WebCenter Sites | =12.2.1.3.0 | |
| Oracle WebCenter Sites | =12.2.1.4.0 | |
| IBM IBM® Engineering Requirements Management DOORS | <=9.7.2.7 | |
| IBM IBM® Engineering Requirements Management DOORS Web Access | <=9.7.2.7 | |
| npm/ckeditor4-dev | <4.16 | 4.16 |
| >=4.0<4.16 | ||
| =9.3.5 | ||
| =9.3.6 | ||
| <21.1.0 | ||
| >=8.0.6<=8.0.9 | ||
| =8.1.0 | ||
| =8.1.1 | ||
| <9.2.6.0 | ||
| <21.9 | ||
| =12.2.1.3.0 | ||
| =12.2.1.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/195665
- https://www.ibm.com/support/pages/node/7124058 (Advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2021-26271
- https://web.archive.org/web/20210128132707/https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first
- https://github.com/advisories/GHSA-jv4c-7jqq-m34x (Advisory)
Frequently Asked Questions
What is CVE-2021-26271?
CVE-2021-26271 is a vulnerability that allows for a ReDoS-type attack in CKEditor 4 before version 4.16.
How does the CVE-2021-26271 vulnerability work?
The CVE-2021-26271 vulnerability can be exploited by persuading a victim to paste crafted text into the Styles input of specific dialogs in CKEditor 4 before version 4.16.
What is the severity of CVE-2021-26271?
The severity of CVE-2021-26271 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2021-26271?
CVE-2021-26271 affects CKEditor versions before 4.16, Oracle Agile PLM 9.3.5, Oracle Agile PLM 9.3.6, Oracle Application Express up to version 21.1.0, Oracle Financial Services Analytical Applications Infrastructure versions 8.0.6 to 8.0.9, Oracle Jd Edwards Enterpriseone Tools up to version 9.2.6.0, Oracle Siebel Ui Framework up to version 21.9, and Oracle WebCenter Sites 12.2.1.3.0 and 12.2.1.4.0.
How can I fix or mitigate the CVE-2021-26271 vulnerability?
To fix the CVE-2021-26271 vulnerability, upgrade CKEditor to version 4.16 or later. Oracle users should refer to Oracle's security advisory for specific mitigation steps.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-jv4c-7jqq-m34x
- alias/CVE-2021-26271
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- vendor/ckeditor
- canonical/ckeditor ckeditor
- version/ckeditor ckeditor/4.0
- vendor/oracle
- canonical/oracle agile plm
- version/oracle agile plm/9.3.5
- version/oracle agile plm/9.3.6
- canonical/oracle application express
- canonical/oracle financial services analytical applications infrastructure
- version/oracle financial services analytical applications infrastructure/8.0.6
- version/oracle financial services analytical applications infrastructure/8.0.9
- version/oracle financial services analytical applications infrastructure/8.1.0
- version/oracle financial services analytical applications infrastructure/8.1.1
- canonical/oracle jd edwards enterpriseone tools
- canonical/oracle siebel ui framework
- canonical/oracle webcenter sites
- version/oracle webcenter sites/12.2.1.3.0
- version/oracle webcenter sites/12.2.1.4.0
- vendor/ibm
- canonical/ibm ibm® engineering requirements management doors
- version/ibm ibm® engineering requirements management doors/9.7.2.7
- canonical/ibm ibm® engineering requirements management doors web access
- version/ibm ibm® engineering requirements management doors web access/9.7.2.7
- package-manager/npm