CVE-2021-37695

Name: CVE-2021-37695
Creator: NVD / NIST
Published: 2021-08-13T00:15:07.397+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.4/10EPSS 1.32%

Last modified Jun 17, 2026

CVE-2021-37695 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. EPSS estimates a 1.32% chance of exploitation in the next 30 days.

Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Metrics

CVSS 3.1

5.4/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

1.32%

67.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Ckeditor	Ckeditor	< 4.16.2
Debian	Debian Linux	9.0
Fedoraproject	Fedora	33
Fedoraproject	Fedora	34
Fedoraproject	Fedora	35
Oracle	Application Express	< 21.1.4
Oracle	Banking Party Management	2.7.0
Oracle	Commerce Guided Search	11.3.2
Oracle	Commerce Merchandising	11.3.2
Oracle	Documaker	12.6.3
Oracle	Documaker	12.6.4
Oracle	Financial Services Analytical Applications Infrastructure	>= 8.0.7, <= 8.1.1
Oracle	Financial Services Analytical Applications Infrastructure	8.0.3
Oracle	Financial Services Model Management And Governance	>= 8.0.8.0.0, <= 8.1.0.0.0
Oracle	Jd Edwards Enterpriseone Tools	< 9.2.6.0
Oracle	Peoplesoft Enterprise Peopletools	8.57
Oracle	Peoplesoft Enterprise Peopletools	8.58
Oracle	Peoplesoft Enterprise Peopletools	8.59

References

https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58Patch, Third Party Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhcThird Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58Patch, Third Party Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhcThird Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Timeline

Published: Aug 13, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-37695?

How severe is CVE-2021-37695?

CVE-2021-37695 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 1.32% probability of exploitation in the next 30 days.

How do I fix CVE-2021-37695?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-37695?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST