CVE-2021-37695: Execution of JavaScript code using malformed HTML in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
Other sources
CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Fake Objects plugin. A remote attacker could exploit this vulnerability using malformed Fake Objects HTML, which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CKEditor 4 Fake Objectsto a version that resolves this vulnerability.Fixed in 4.16.2 - Configuration
Update CKEditor 4 to version 4.16.2 (vulnerable when < 4.16.2) so the Fake Objects plugin properly validates user-supplied input to prevent JavaScript execution from malformed Fake Objects HTML.
CKEditor 4 (Fake Objects plugin) user-supplied input validation = properly validate/sanitize malformed Fake Objects HTML input (patched behavior present in version 4.16.2)
Event History
Frequently Asked Questions
What is the vulnerability ID of this CKEditor vulnerability?
The vulnerability ID is CVE-2021-37695.
What is CKEditor?
CKEditor is an open source WYSIWYG HTML editor with rich content support.
What is the severity of CVE-2021-37695?
The severity of CVE-2021-37695 is high with a CVSS score of 5.4.
How does CVE-2021-37695 impact CKEditor 4?
CVE-2021-37695 allows the injection of malformed Fake Objects HTML, which could result in executing arbitrary code.
How can I fix CVE-2021-37695?
To fix CVE-2021-37695, upgrade to CKEditor version 4.16.3 or later.