VYPR
← All advisories
High severity8.2NVD Advisory· Published Nov 17, 2021· Updated Jun 17, 2026

CVE-2021-41165

CVE-2021-41165

Description

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ckeditor4npm
< 4.17.04.17.0
ckeditor/ckeditorPackagist
< 4.17.04.17.0

Affected products

23
  • Fckeditor/Fckeditor
    cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*
    Range: <4.17.0
  • Drupal/Drupal
    cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
    Range: >=8.9.0,<8.9.20
  • Oracle Corporation/Agile Product Lifecycle Management
    cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
  • Oracle Corporation/Application Express
    cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*
    Range: <22.1
  • Oracle Corporation/Banking Apis5 versions
    cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*range: >=18.1,<=18.3
    • cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Digital Experience5 versions
    cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*range: >=18.1,<=18.3
    • cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*
  • Oracle Corporation/Commerce Guided Search
    cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*
  • Oracle Corporation/Peoplesoft Enterprise Peopletools2 versions
    cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
  • Oracle Corporation/Webcenter Portal2 versions
    cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
  • osv-coords3 versions
    pkg:bitnami/drupalpkg:composer/ckeditor/ckeditorpkg:npm/ckeditor4
    >= 8.9.0, < 8.9.20+ 2 more
    • (no CPE)range: >= 8.9.0, < 8.9.20
    • (no CPE)range: < 4.17.0
    • (no CPE)range: < 4.17.0
  • Fckeditor/Ckeditor4cpe-rescue
    Range: < 4.17.0

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.