CVE-2021-41165: HTML comments vulnerability allowing to execute JavaScript code
First published: Wed Nov 17 2021(Updated: )
### Affected packages The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. ### Impact A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. ### Patches The problem has been recognized and patched. The fix will be available in version 4.17.0. ### For more information Email us at security@cksource.com if you have any questions or comments about this advisory. ### Acknowledgements The CKEditor 4 team would like to thank William Bowling ([wbowling](https://github.com/wbowling)) for recognizing and reporting this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ckeditor Ckeditor | <4.17.0 | |
| Drupal Drupal | >=8.9.0<8.9.20 | |
| Drupal Drupal | >=9.1.0<9.1.14 | |
| Drupal Drupal | >=9.2.0<9.2.9 | |
| Oracle Agile Product Lifecycle Management | =9.3.6 | |
| Oracle Application Express | <22.1 | |
| Oracle Banking Apis | >=18.1<=18.3 | |
| Oracle Banking Apis | =19.1 | |
| Oracle Banking Apis | =19.2 | |
| Oracle Banking Apis | =20.1 | |
| Oracle Banking Apis | =21.1 | |
| Oracle Banking Digital Experience | >=18.1<=18.3 | |
| Oracle Banking Digital Experience | =19.1 | |
| Oracle Banking Digital Experience | =19.2 | |
| Oracle Banking Digital Experience | =20.1 | |
| Oracle Banking Digital Experience | =21.1 | |
| Oracle Commerce Guided Search | =11.3.2 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.58 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.59 | |
| Oracle WebCenter Portal | =12.2.1.3.0 | |
| Oracle WebCenter Portal | =12.2.1.4.0 | |
| composer/ckeditor/ckeditor | <4.17.0 | 4.17.0 |
| npm/ckeditor4 | <4.17.0 | 4.17.0 |
| IBM IBM® Engineering Requirements Management DOORS | <=9.7.2.7 | |
| IBM IBM® Engineering Requirements Management DOORS Web Access | <=9.7.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2
- https://www.drupal.org/sa-core-2021-011
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-41165
- https://github.com/advisories/GHSA-7h26-63m7-qhf2 (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/213846
- https://www.ibm.com/support/pages/node/7124058 (Advisory)
Frequently Asked Questions
What is CVE-2021-41165?
CVE-2021-41165 is a vulnerability discovered in CKEditor 4, an open source WYSIWYG HTML editor.
How does CVE-2021-41165 affect CKEditor 4?
CVE-2021-41165 affects the core HTML processing module of CKEditor 4 and may affect all plugins used by CKEditor 4.
What is the severity of CVE-2021-41165?
The severity of CVE-2021-41165 is high, with a CVSS score of 5.4.
Which software versions are affected by CVE-2021-41165?
CKEditor 4 version up to 4.17.0, Drupal 8.9.0 to 8.9.20, Drupal 9.1.0 to 9.1.14, Drupal 9.2.0 to 9.2.9, Oracle Agile Product Lifecycle Management 9.3.6, Oracle Application Express up to version 22.1, Oracle Banking Apis 18.1 to 18.3, Oracle Banking Apis 19.1 to 21.1, Oracle Banking Digital Experience 18.1 to 18.3, Oracle Banking Digital Experience 19.1 to 21.1, Oracle Commerce Guided Search 11.3.2, Oracle PeopleSoft Enterprise PeopleTools 8.58, Oracle PeopleSoft Enterprise PeopleTools 8.59, Oracle WebCenter Portal 12.2.1.3.0, and Oracle WebCenter Portal 12.2.1.4.0 are affected by CVE-2021-41165.
How can I fix CVE-2021-41165?
To fix CVE-2021-41165, you should update CKEditor 4 to version 4.17.1 or later, or apply the necessary patches or updates provided by the affected software vendors.
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-7h26-63m7-qhf2
- alias/CVE-2021-41165
- collector/github-advisory
- agent/author
- agent/type
- agent/remedy
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/ckeditor
- canonical/ckeditor ckeditor
- vendor/drupal
- canonical/drupal drupal
- version/drupal drupal/8.9.0
- version/drupal drupal/9.1.0
- version/drupal drupal/9.2.0
- vendor/oracle
- canonical/oracle agile product lifecycle management
- version/oracle agile product lifecycle management/9.3.6
- canonical/oracle application express
- canonical/oracle banking apis
- version/oracle banking apis/18.1
- version/oracle banking apis/18.3
- version/oracle banking apis/19.1
- version/oracle banking apis/19.2
- version/oracle banking apis/20.1
- version/oracle banking apis/21.1
- canonical/oracle banking digital experience
- version/oracle banking digital experience/18.1
- version/oracle banking digital experience/18.3
- version/oracle banking digital experience/19.1
- version/oracle banking digital experience/19.2
- version/oracle banking digital experience/20.1
- version/oracle banking digital experience/21.1
- canonical/oracle commerce guided search
- version/oracle commerce guided search/11.3.2
- canonical/oracle peoplesoft enterprise peopletools
- version/oracle peoplesoft enterprise peopletools/8.58
- version/oracle peoplesoft enterprise peopletools/8.59
- canonical/oracle webcenter portal
- version/oracle webcenter portal/12.2.1.3.0
- version/oracle webcenter portal/12.2.1.4.0
- package-manager/composer
- package-manager/npm
- vendor/ibm
- canonical/ibm ibm® engineering requirements management doors
- version/ibm ibm® engineering requirements management doors/9.7.2.7
- canonical/ibm ibm® engineering requirements management doors web access
- version/ibm ibm® engineering requirements management doors web access/9.7.2.7