CVE-2021-41165
MEDIUMCVSS 5.4/10EPSS 1.47%
Last modified
CVE-2021-41165 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. EPSS estimates a 1.47% chance of exploitation in the next 30 days.
Description
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ckeditor | Ckeditor | < 4.17.0 |
| Drupal | Drupal | >= 8.9.0, < 8.9.20 |
| Drupal | Drupal | >= 9.1.0, < 9.1.14 |
| Drupal | Drupal | >= 9.2.0, < 9.2.9 |
| Oracle | Agile Product Lifecycle Management | 9.3.6 |
| Oracle | Application Express | < 22.1 |
| Oracle | Banking Apis | >= 18.1, <= 18.3 |
| Oracle | Banking Apis | 19.1 |
| Oracle | Banking Apis | 19.2 |
| Oracle | Banking Apis | 20.1 |
| Oracle | Banking Apis | 21.1 |
| Oracle | Banking Digital Experience | >= 18.1, <= 18.3 |
| Oracle | Banking Digital Experience | 19.1 |
| Oracle | Banking Digital Experience | 19.2 |
| Oracle | Banking Digital Experience | 20.1 |
| Oracle | Banking Digital Experience | 21.1 |
| Oracle | Commerce Guided Search | 11.3.2 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.58 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.59 |
| Oracle | Webcenter Portal | 12.2.1.3.0 |
| Oracle | Webcenter Portal | 12.2.1.4.0 |
References
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417Third Party Advisory
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2Third Party Advisory
- https://www.drupal.org/sa-core-2021-011Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417Third Party Advisory
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2Third Party Advisory
- https://www.drupal.org/sa-core-2021-011Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-41165?
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
How severe is CVE-2021-41165?
CVE-2021-41165 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 1.47% probability of exploitation in the next 30 days.
How do I fix CVE-2021-41165?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-4116yetiforcecrm is vulnerable to Improper Neutralization of Inp…5.4
- CVE-2021-41160FreeRDP is a free implementation of the Remote Desktop Proto…8.8
- CVE-2021-41161Combodo iTop is a web based IT Service Management tool. In v…6.1
- CVE-2021-41162Combodo iTop is a web based IT Service Management tool. In 3…6.1
- CVE-2021-41163Discourse is an open source platform for community discussio…9.8
- CVE-2021-41164CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
- CVE-2021-41166The Nextcloud Android app is the Android client for Nextclou…5.3
- CVE-2021-41167modern-async is an open source JavaScript tooling library fo…7.5
- CVE-2021-41168Snudown is a reddit-specific fork of the Sundown Markdown pa…6.5
- CVE-2021-41169Sulu is an open-source PHP content management system based o…4.8
- CVE-2021-4117yetiforcecrm is vulnerable to Business Logic Errors4.3
- CVE-2021-41170neoan3-apps/template is a neoan3 minimal template engine. Ve…9.8
Are you affected by CVE-2021-41165?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST