VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Mar 7, 2020· Updated Jun 17, 2026

CVE-2020-9281

CVE-2020-9281

Description

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ckeditor4npm
< 4.14.04.14.0

Affected products

26
  • Fckeditor/Fckeditor
    cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*
    Range: >=4.0,<4.14
  • Drupal/Drupal
    cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
    Range: >=8.7.0,<8.7.12
  • Oracle Corporation/Agile Plm2 versions
    cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
  • Oracle Corporation/Application Express
    cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*
    Range: <20.2
  • Oracle Corporation/Banking Enterprise Default Management5 versions
    cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Enterprise Default Managment
    cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:*
    Range: >=2.3.0,<=2.4.0
  • Oracle Corporation/Jd Edwards Enterpriseone
    cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
    Range: <9.2.5.2
  • Oracle Corporation/Peoplesoft Enterprise Peopletools4 versions
    cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:-:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:-:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
  • Oracle Corporation/Siebel Apps Customer Order Management
    cpe:2.3:a:oracle:siebel_apps_-_customer_order_management:*:*:*:*:*:*:*:*
    Range: <21.0
  • Oracle Corporation/Webcenter Portal3 versions
    cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
  • Fedoraproject/Fedora3 versions
    cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
  • CKEditor/CKEditordescription
  • osv-coords2 versions
    pkg:bitnami/drupalpkg:npm/ckeditor4
    >= 8.7.0, < 8.7.12+ 1 more
    • (no CPE)range: >= 8.7.0, < 8.7.12
    • (no CPE)range: < 4.14.0

Patches

Vulnerability mechanics

References

13

News mentions

0

No linked articles in our index yet.