CVE-2021-41164

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-41164
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41164.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-41164
Aliases
Downstream
Published
2021-11-17T19:15:08Z
Modified
2026-10-20T10:54:57Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "22.1"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "oracle:application_express"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "18.1"
                        },
                        {
                            "last_affected":  "18.3"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "oracle:banking_apis"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "18.1"
                        },
                        {
                            "last_affected":  "18.3"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "oracle:banking_digital_experience"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "36"
                        },
                        {
                            "last_affected":  "36"
                        },
                        {
                            "introduced":  "37"
                        },
                        {
                            "last_affected":  "37"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "9.3.6"
                        },
                        {
                            "last_affected":  "9.3.6"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:agile_product_lifecycle_management"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "19.1"
                        },
                        {
                            "last_affected":  "19.1"
                        },
                        {
                            "introduced":  "19.2"
                        },
                        {
                            "last_affected":  "19.2"
                        },
                        {
                            "introduced":  "20.1"
                        },
                        {
                            "last_affected":  "20.1"
                        },
                        {
                            "introduced":  "21.1"
                        },
                        {
                            "last_affected":  "21.1"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:banking_apis"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "19.1"
                        },
                        {
                            "last_affected":  "19.1"
                        },
                        {
                            "introduced":  "19.2"
                        },
                        {
                            "last_affected":  "19.2"
                        },
                        {
                            "introduced":  "20.1"
                        },
                        {
                            "last_affected":  "20.1"
                        },
                        {
                            "introduced":  "21.1"
                        },
                        {
                            "last_affected":  "21.1"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:banking_digital_experience"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "11.3.2"
                        },
                        {
                            "last_affected":  "11.3.2"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:commerce_guided_search"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "8.58"
                        },
                        {
                            "last_affected":  "8.58"
                        },
                        {
                            "introduced":  "8.59"
                        },
                        {
                            "last_affected":  "8.59"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:peoplesoft_enterprise_peopletools"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "12.2.1.3.0"
                        },
                        {
                            "last_affected":  "12.2.1.3.0"
                        },
                        {
                            "introduced":  "12.2.1.4.0"
                        },
                        {
                            "last_affected":  "12.2.1.4.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:webcenter_portal"
        }
    ]
}
References

Affected packages

Git
github.com/ckeditor/ckeditor4

Affected ranges

Type
GIT
Repo
https://github.com/ckeditor/ckeditor4
Events
Introduced
769d96134bcf29f5d3d870e25797ce9b9dc8289e
Fixed
cab78d432999c8bcd8213a2e0786026a5f9a44dc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0"
                },
                {
                    "fixed":  "4.17.0"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

4.*
4.0
4.0.0
4.0.1
4.1
4.1.0
4.10.0
4.12.0
4.13.0
4.14.0
4.15.0
4.16.0
4.1rc
4.2
4.2.0
4.2.1
4.2.2
4.2.3
4.4.0
4.4.1
4.5.0
4.5.0-beta
4.6.0
4.7.0
4.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41164.json"
github.com/ckeditor/ckeditor4-releases

Affected ranges

Type
GIT
Repo
https://github.com/ckeditor/ckeditor4-releases
Events
Introduced
870a561110a23435d78eda377400dca7f64d3bd3
Fixed
5a0d3c84b4bc9eb7d1ecd8dfa9b660eb691553c2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0"
                },
                {
                    "fixed":  "4.17.0"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

4.*
4.0.1/standard
4.0/standard
4.1.1/standard
4.1.2/standard
4.1.3/standard
4.1/standard
4.1rc/standard
4.2.1/standard
4.2.2/standard
4.2.3/standard
4.2/standard
4.3.0/standard
4.3.1/standard
4.3.2/standard
standard/4.*
standard/4.10.0
standard/4.10.1
standard/4.11.0
standard/4.11.1
standard/4.11.2
standard/4.11.3
standard/4.11.4
standard/4.12.0
standard/4.12.1
standard/4.13.0
standard/4.13.1
standard/4.14.0
standard/4.14.1
standard/4.15.0
standard/4.15.1
standard/4.16.0
standard/4.16.1
standard/4.16.2
standard/4.3.3
standard/4.3.4
standard/4.3.5
standard/4.4.0
standard/4.4.1
standard/4.4.2
standard/4.4.3
standard/4.4.4
standard/4.4.5
standard/4.4.6
standard/4.4.7
standard/4.4.8
standard/4.5.0
standard/4.5.1
standard/4.5.10
standard/4.5.11
standard/4.5.2
standard/4.5.3
standard/4.5.4
standard/4.5.5
standard/4.5.6
standard/4.5.7
standard/4.5.8
standard/4.5.9
standard/4.6.0
standard/4.6.1
standard/4.6.2
standard/4.7.0
standard/4.7.1
standard/4.7.2
standard/4.7.3
standard/4.8.0
standard/4.9.0
standard/4.9.1
standard/4.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41164.json"
github.com/drupal/drupal

Affected ranges

Type
GIT
Repo
https://github.com/drupal/drupal
Events
Introduced
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70
Fixed
e187f925ed6aa9d9d4b3121904c077aa54ba108a
Introduced
5c6f14f762c9aef87cd2731818386f202ee8463c
Fixed
0398571aae84442c8fad6e9ce307aefb8c293b20
Introduced
943ecef3c0bc9822338252a7df6419aeb9253c9d
Fixed
ae75f828134e57bb1aed2ffb2635e6b28fc0e040
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "8.9.0"
                },
                {
                    "fixed":  "8.9.20"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "9.1.0"
                },
                {
                    "fixed":  "9.1.14"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "9.2.0"
                },
                {
                    "fixed":  "9.2.9"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

8.*
8.9.0
8.9.11
8.9.12
8.9.15
8.9.16
8.9.17
8.9.18
8.9.19
8.9.2
8.9.3
8.9.4
8.9.5
8.9.8
9.*
9.1.0
9.1.1
9.1.10
9.1.11
9.1.12
9.1.13
9.1.2
9.1.4
9.1.5
9.1.6
9.1.8
9.2.0
9.2.1
9.2.3
9.2.5
9.2.7
9.2.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41164.json"