CVE-2021-32808

CVE	CVE-2021-32808
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-08-12 17:15:00 UTC
Updated	2023-11-07 03:35:00 UTC
Description	ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Problem Types: CWE-79

Type	Vendor	Product	Version	Update	Edition	Language
Application	Ckeditor	Ckeditor	All	All	All	All
Operating System	Fedoraproject	Fedora	33	All	All	All
Operating System	Fedoraproject	Fedora	34	All	All	All
Operating System	Fedoraproject	Fedora	35	All	All	All
Application	Oracle	Application Express	All	All	All	All
Application	Oracle	Application Express	All	All	All	All
Application	Oracle	Banking Party Management	2.7.0	All	All	All
Application	Oracle	Commerce Guided Search	11.3.2	All	All	All
Application	Oracle	Commerce Merchandising	11.3.2	All	All	All
Application	Oracle	Documaker	12.6.3	All	All	All
Application	Oracle	Documaker	12.6.4	All	All	All
Application	Oracle	Financial Services Analytical Applications Infrastructure	All	All	All	All
Application	Oracle	Financial Services Model Management And Governance	8.0.8.0.0	All	All	All
Application	Oracle	Financial Services Model Management And Governance	8.1.0.0.0	All	All	All
Application	Oracle	Jd Edwards Enterpriseone Tools	All	All	All	All
Application	Oracle	Peoplesoft Enterprise Peopletools	8.57	All	All	All
Application	Oracle	Peoplesoft Enterprise Peopletools	8.58	All	All	All
Application	Oracle	Peoplesoft Enterprise Peopletools	8.59	All	All	All
Application	Oracle	Siebel Ui Framework	All	All	All	All
Application	Oracle	Webcenter Sites	12.2.1.3.0	All	All	All
Application	Oracle	Webcenter Sites	12.2.1.4.0	All	All	All

Reference	Source	Link	Tags
[SECURITY] Fedora 35 Update: ckeditor-4.16.2-1.fc35 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 33 Update: ckeditor-4.16.2-1.fc33 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 33 Update: ckeditor-4.16.2-1.fc33 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
Oracle Critical Patch Update Advisory - October 2021	MISC	www.oracle.com
Oracle Critical Patch Update Advisory - January 2022	MISC	www.oracle.com
[SECURITY] Fedora 34 Update: ckeditor-4.16.2-1.fc34 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 34 Update: ckeditor-4.16.2-1.fc34 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 35 Update: ckeditor-4.16.2-1.fc35 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
Release 4.16.2 · ckeditor/ckeditor4 · GitHub	MISC	github.com
Widget feature vulnerability allowing to execute JavaScript code using undo functionality · Advisory · ckeditor/ckeditor4 · GitHub	CONFIRM	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

184565 Debian Security Update for ckeditor (CVE-2021-32808)
198710 Ubuntu Security Notification for CKEditor Vulnerabilities (USN-5340-1)
281934 Fedora Security Update for ckeditor (FEDORA-2021-87578dca12)
281935 Fedora Security Update for ckeditor (FEDORA-2021-72176a63a8)
376257 Oracle PeopleSoft Enterprise PeopleTools Product Multiple Vulnerabilities (CPUJAN2022)
980367 Nodejs (npm) Security Update for ckeditor4 (GHSA-6226-h7ff-ch6c)