CVE-2020-9281

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

References

Affected packages

Git / github.com/ckeditor/ckeditor-releases

Affected ranges

Type

GIT

Repo

https://github.com/ckeditor/ckeditor-releases

Events

Introduced

870a561110a23435d78eda377400dca7f64d3bd3

Fixed

0d574568baeddda92f231681ea5aac4860dca4e4

Database specific

{
    "versions": [
        {
            "introduced": "4.0"
        },
        {
            "fixed": "4.14"
        }
    ]
}

Type

GIT

Repo

https://github.com/drupal/drupal

Events

Introduced

17ba30046ed57677de4feff8d07354890b40efdb

Fixed

6b8876efb37dd2b57aa96d5cec66572a72550869

Introduced

f2b59e3ae8097ea01d15c708f1267b73794399c0

Fixed

b41facbb7853266788c489ad3c4f932dbdd18809

Introduced

Last affected

76ed7a0eb51113ad0f4b0147cb6ecf607edd41f6

Introduced

Last affected

e205f31c36c6db950f50d473cfd24ad22ac98ae1

Database specific

{
    "versions": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.12"
        },
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.3.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.3.6"
        }
    ]
}

Affected versions

1.*

1.0

2.*

2.0

3.*

3.0.1

4.*

4.0.1/standard

4.0/standard

4.1.1/standard

4.1.2/standard

4.1.3/standard

4.1/standard

4.1rc/standard

4.2.1/standard

4.2.2/standard

4.2.3/standard

4.2/standard

4.3.0/standard

4.3.1/standard

4.3.2/standard

5.*

5.0-beta-1

5.0-beta-2

5.0-rc-1

5.0-rc-2

6.*

6.0-beta-1

6.0-beta-2

6.0-beta-3

6.0-beta-4

6.0-rc-1

6.0-rc-2

6.0-rc-3

7.*

7.0

7.0-alpha1

7.0-alpha2

7.0-alpha3

7.0-alpha4

7.0-alpha5

7.0-alpha6

7.0-alpha7

7.0-beta1

7.0-beta2

7.0-beta3

7.0-rc-1

7.0-rc-2

7.0-rc-3

7.0-rc-4

7.0-unstable-1

7.0-unstable-10

7.0-unstable-2

7.0-unstable-3

7.0-unstable-4

7.0-unstable-5

7.0-unstable-6

7.0-unstable-7

8.*

8.0-alpha10

8.0-alpha11

8.0-alpha12

8.0-alpha13

8.0-alpha2

8.0-alpha3

8.0-alpha4

8.0-alpha5

8.0-alpha6

8.0-alpha7

8.0-alpha8

8.0-alpha9

8.0.0

8.0.0-alpha14

8.0.0-alpha15

8.0.0-beta1

8.0.0-beta10

8.0.0-beta11

8.0.0-beta12

8.0.0-beta13

8.0.0-beta14

8.0.0-beta15

8.0.0-beta16

8.0.0-beta2

8.0.0-beta3

8.0.0-beta4

8.0.0-beta5

8.0.0-beta6

8.0.0-beta7

8.0.0-beta9

8.0.0-rc1

8.0.0-rc2

8.0.0-rc3

8.0.0-rc4

8.1.0-beta1

8.7.0-alpha1

8.7.0-alpha2

8.7.0-beta1

8.7.0-beta2

8.7.0-rc1

8.7.10

8.7.11

8.7.2

8.7.3

8.7.4

8.7.6

8.7.7

8.7.8

8.7.9

8.8.0

8.8.2

8.8.3

9.*

9.0.0-alpha1

9.0.0-alpha2

9.3.0

9.3.0-alpha1

9.3.0-beta1

9.3.0-beta2

9.3.0-beta3

9.3.0-rc1

9.3.2

9.3.4

9.3.5

9.3.6

standard/4.*

standard/4.10.0

standard/4.10.1

standard/4.11.0

standard/4.11.1

standard/4.11.2

standard/4.11.3

standard/4.11.4

standard/4.12.0

standard/4.12.1

standard/4.13.0

standard/4.13.1

standard/4.3.3

standard/4.3.4

standard/4.3.5

standard/4.4.0

standard/4.4.1

standard/4.4.2

standard/4.4.3

standard/4.4.4

standard/4.4.5

standard/4.4.6

standard/4.4.7

standard/4.4.8

standard/4.5.0

standard/4.5.1

standard/4.5.10

standard/4.5.11

standard/4.5.2

standard/4.5.3

standard/4.5.4

standard/4.5.5

standard/4.5.6

standard/4.5.7

standard/4.5.8

standard/4.5.9

standard/4.6.0

standard/4.6.1

standard/4.6.2

standard/4.7.0

standard/4.7.1

standard/4.7.2

standard/4.7.3

standard/4.8.0

standard/4.9.0

standard/4.9.1

standard/4.9.2

Other

start

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9281.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "30"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "20.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "9.2.5.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.56"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.57"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.58"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "21.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.1.1.9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.1.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.1.4.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.6.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.7.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.12.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2.3.0"
            },
            {
                "last_affected": "2.4.0"
            }
        ]
    }
]