CVE-2021-41165: HTML comments vulnerability allowing to execute JavaScript code
Affected packages The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.
Impact A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.
Patches The problem has been recognized and patched. The fix will be available in version 4.17.0.
For more information Email us at security@cksource.com if you have any questions or comments about this advisory.
Acknowledgements The CKEditor 4 team would like to thank William Bowling (wbowling) for recognizing and reporting this vulnerability.
Other sources
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
— MITRE
CKEditor4 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability using the core HTML processing module to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-41165?
CVE-2021-41165 is a vulnerability discovered in CKEditor 4, an open source WYSIWYG HTML editor.
How does CVE-2021-41165 affect CKEditor 4?
CVE-2021-41165 affects the core HTML processing module of CKEditor 4 and may affect all plugins used by CKEditor 4.
What is the severity of CVE-2021-41165?
The severity of CVE-2021-41165 is high, with a CVSS score of 5.4.
Which software versions are affected by CVE-2021-41165?
CKEditor 4 version up to 4.17.0, Drupal 8.9.0 to 8.9.20, Drupal 9.1.0 to 9.1.14, Drupal 9.2.0 to 9.2.9, Oracle Agile Product Lifecycle Management 9.3.6, Oracle Application Express up to version 22.1, Oracle Banking Apis 18.1 to 18.3, Oracle Banking Apis 19.1 to 21.1, Oracle Banking Digital Experience 18.1 to 18.3, Oracle Banking Digital Experience 19.1 to 21.1, Oracle Commerce Guided Search 11.3.2, Oracle PeopleSoft Enterprise PeopleTools 8.58, Oracle PeopleSoft Enterprise PeopleTools 8.59, Oracle WebCenter Portal 12.2.1.3.0, and Oracle WebCenter Portal 12.2.1.4.0 are affected by CVE-2021-41165.
How can I fix CVE-2021-41165?
To fix CVE-2021-41165, you should update CKEditor 4 to version 4.17.1 or later, or apply the necessary patches or updates provided by the affected software vendors.