תיאור (מקור, אנגלית)
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
מוצרים מושפעים
ckeditor: ckeditor; oracle: agile product lifecycle management; oracle: application express; oracle: banking party management; oracle: commerce merchandising; oracle: financial services analytical applications infrastructure; oracle: financial services model management and governance; oracle: jd edwards enterpriseone tools; oracle: siebel ui framework; oracle: webcenter sites
קישורים10
- ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-Hi… Vendor Advisory
- ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-Hi… Vendor Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416 Release NotesThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.html Not ApplicableThird Party Advisory
- github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416 Release NotesThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.html Not ApplicableThird Party Advisory
מדדים
- CVSS 3.1
-
6.5
MEDIUM
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - EPSS — סבירות ניצול
- 2% אחוזון 84 · נכון ל-11 בנובמבר 2026
- CWE
- CWE-829
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.