Vulnerability advisory
CVE-2021-33829
Also known as BIT-drupal-2021-33829DRUPAL-CORE-2021-003GHSA-rgx6-rjj4-c388
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/ckeditor/ckeditor4 ↗ | |
| 8a12b041718e05eeffb62a931d95995ac72cbe22 to before cae20318d46745cc46c811da4e7d68b38ca32449 | cae20318d46745cc46c811da4e7d68b38ca32449 |
| GIT github.com/ckeditor/ckeditor4-releases ↗ | |
| 0d574568baeddda92f231681ea5aac4860dca4e4 to before a0d9ddd4b80b3dcc1d1bc8c2acc2d43e4c96b660 | a0d9ddd4b80b3dcc1d1bc8c2acc2d43e4c96b660 |
Also listed as affected (5)
| |
| GIT github.com/drupal/drupal ↗ | |
| a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before 1667e06929722a8d913ef989cc00f70a38129d6d | 1667e06929722a8d913ef989cc00f70a38129d6d |
| d62812dc17ce593beb2ccd4cdbee1a76c95e3fd7 to before ac80ed0600b9437c5959d3293cdbc67be0b7d320 | ac80ed0600b9437c5959d3293cdbc67be0b7d320 |
| 5c6f14f762c9aef87cd2731818386f202ee8463c to before c1b981a183d874efbc3cd211373067b574c8f1cb | c1b981a183d874efbc3cd211373067b574c8f1cb |
Also listed as affected (22)
| |
Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
References
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ ↗
- Advisorylists.debian.org/debian-lts-announce/2021/11/msg00007.html ↗
- Fixckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser ↗
- Fixwww.drupal.org/sa-core-2021-003 ↗