Moderate severityNVD Advisory· Published Jun 9, 2021· Updated Aug 3, 2024
CVE-2021-33829
CVE-2021-33829
Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ckeditor4npm | >= 4.14.0, < 4.16.1 | 4.16.1 |
drupal/corePackagist | >= 7.0.0, < 7.80 | 7.80 |
drupal/corePackagist | >= 8.0.0, < 8.9.16 | 8.9.16 |
drupal/corePackagist | >= 9.0.0, < 9.0.14 | 9.0.14 |
drupal/corePackagist | >= 9.1.0, < 9.1.9 | 9.1.9 |
drupal/drupalPackagist | >= 7.0.0, < 7.80 | 7.80 |
drupal/drupalPackagist | >= 8.0.0, < 8.9.16 | 8.9.16 |
drupal/drupalPackagist | >= 9.0.0, < 9.0.14 | 9.0.14 |
drupal/drupalPackagist | >= 9.1.0, < 9.1.9 | 9.1.9 |
Affected products
5- CKEditor/CKEditor 4description
- osv-coords4 versions
>= 8.9.0, < 8.9.16+ 3 more
- (no CPE)range: >= 8.9.0, < 8.9.16
- (no CPE)range: >= 7.0.0, < 7.80
- (no CPE)range: >= 7.0.0, < 7.80
- (no CPE)range: >= 4.14.0, < 4.16.1
Patches
Vulnerability mechanics
References
14- github.com/advisories/GHSA-rgx6-rjj4-c388ghsaADVISORY
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/mitrevendor-advisoryx_refsource_FEDORA
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/mitrevendor-advisoryx_refsource_FEDORA
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/mitrevendor-advisoryx_refsource_FEDORA
- nvd.nist.gov/vuln/detail/CVE-2021-33829ghsaADVISORY
- ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/ghsax_refsource_MISCWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2021-33829.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2021-33829.yamlghsaWEB
- lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlghsamailing-listx_refsource_MLISTWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3TghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGWghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XDghsaWEB
- www.drupal.org/sa-core-2021-003ghsax_refsource_CONFIRMWEB
- www.npmjs.com/package/ckeditor4ghsaWEB
News mentions
0No linked articles in our index yet.