CVE-2021-26271: Medium severity IBM IBM® Engineering Requirements Management DOORS vulnerability
CKEditor is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Advanced Tab for Dialogs plugin. By persuading a victim to paste specially-crafted text into the Styles input of specific dialogs, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Other sources
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ckeditor4-devto a version that resolves this vulnerability.Fixed in 4.16
Event History
Frequently Asked Questions
What is CVE-2021-26271?
CVE-2021-26271 is a vulnerability that allows for a ReDoS-type attack in CKEditor 4 before version 4.16.
How does the CVE-2021-26271 vulnerability work?
The CVE-2021-26271 vulnerability can be exploited by persuading a victim to paste crafted text into the Styles input of specific dialogs in CKEditor 4 before version 4.16.
What is the severity of CVE-2021-26271?
The severity of CVE-2021-26271 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2021-26271?
CVE-2021-26271 affects CKEditor versions before 4.16, Oracle Agile PLM 9.3.5, Oracle Agile PLM 9.3.6, Oracle Application Express up to version 21.1.0, Oracle Financial Services Analytical Applications Infrastructure versions 8.0.6 to 8.0.9, Oracle Jd Edwards Enterpriseone Tools up to version 9.2.6.0, Oracle Siebel Ui Framework up to version 21.9, and Oracle WebCenter Sites 12.2.1.3.0 and 12.2.1.4.0.
How can I fix or mitigate the CVE-2021-26271 vulnerability?
To fix the CVE-2021-26271 vulnerability, upgrade CKEditor to version 4.16 or later. Oracle users should refer to Oracle's security advisory for specific mitigation steps.