CVE-2021-26272

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2021-26272
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-01-26 21:15:00 UTC
Updated2022-03-01 17:18:00 UTC
DescriptionIt was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Risk And Classification

Problem Types: CWE-829

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Ckeditor Ckeditor All All All All
Application Ckeditor Ckeditor All All All All
Application Oracle Agile Plm 9.3.5 All All All
Application Oracle Agile Plm 9.3.6 All All All
Application Oracle Application Express All All All All
Application Oracle Banking Party Management 2.7.0 All All All
Application Oracle Commerce Merchandising 11.1.0 All All All
Application Oracle Commerce Merchandising 11.2.0 All All All
Application Oracle Commerce Merchandising All All All All
Application Oracle Financial Services Analytical Applications Infrastructure 8.1.0 All All All
Application Oracle Financial Services Analytical Applications Infrastructure 8.1.1 All All All
Application Oracle Financial Services Analytical Applications Infrastructure All All All All
Application Oracle Financial Services Model Management And Governance All All All All
Application Oracle Jd Edwards Enterpriseone Tools All All All All
Application Oracle Siebel Ui Framework All All All All
Application Oracle Webcenter Sites 12.2.1.3.0 All All All
Application Oracle Webcenter Sites 12.2.1.4.0 All All All

References

ReferenceSourceLinkTags
ckeditor4/CHANGES.md at major · ckeditor/ckeditor4 · GitHub MISC github.com Release Notes, Third Party Advisory
Oracle Critical Patch Update Advisory - July 2021 N/A www.oracle.com
Oracle Critical Patch Update Advisory - October 2021 MISC www.oracle.com
Oracle Critical Patch Update Advisory - January 2022 MISC www.oracle.com
CKEditor 4.16 with improved image pasting, High Contrast support and a new color API MISC ckeditor.com Vendor Advisory
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 179922 Debian Security Update for ckeditor (CVE-2021-26272)
  • 20232 Oracle Database 21c Critical Patch Update - October 2021
  • 20233 Oracle Database 19c Critical Patch Update - October 2021
  • 20234 Oracle Database 12.2.0.1 Critical Patch Update - October 2021
  • 20235 Oracle Database 12.2.0.1 Critical Patch Update - October 2021 (Unauthenticated)
  • 20237 Oracle Database 12.1.0.2 Critical Patch Update - October 2021
  • 20238 Oracle Database 12.1.0.2 Critical Patch Update - October 2021 (Unauthenticated)
  • 980331 Nodejs (npm) Security Update for ckeditor4 (GHSA-wpvm-wqr4-p7cw)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report