CVE-2021-26272

MEDIUM · 6.5 CVSS Gepubliceerd: 26-01-2021 CWE-829

Beschrijving

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Vendors

Ckeditor Oracle

Affected products

Ckeditor Agile Product Lifecycle Management Application Express Banking Party Management Commerce Merchandising Financial Services Analytical Applications Infrastructure Financial Services Model Management And Governance Jd Edwards Enterpriseone Tools Siebel Ui Framework Webcenter Sites

References

ckeditor.com
github.com
www.oracle.com
www.oracle.com
www.oracle.com