CVE-2021-26272

תיאור (מקור, אנגלית)

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS — סבירות ניצול

2% (אחוזון 100) נכון ל-18/10/2026

CWE

CWE-829

מוצרים מושפעים

ckeditor: ckeditor; oracle: agile product lifecycle management; oracle: application express; oracle: banking party management; oracle: commerce merchandising; oracle: financial services analytical applications infrastructure; oracle: financial services model management and governance; oracle: jd edwards enterpriseone tools; oracle: siebel ui framework; oracle: webcenter sites

קישורים

• https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contr‮… Vendor Advisory
• https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contr‮… Vendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416 Release NotesThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.html Not ApplicableThird Party Advisory
• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416 Release NotesThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.html Not ApplicableThird Party Advisory