NexaPulse
Subscribe
6.1mediumMedium

CVE-2020-27193

Ckeditor Ckeditor

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, someone has to be persuaded to take an action first.

Scoring

CVSS
6.1 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Assigned by
cve@mitre.org

Dates

Published
2020-11-12
Last modified
2026-08-25
Sources
NVD

Affected products

  • Ckeditor Ckeditor4.15.0
  • Oracle Agile Product Lifecycle Management9.3.5, 9.3.6
  • Oracle Application Express- 21.1.0.00.01
  • Oracle Banking Party Management2.7.0
  • Oracle Banking Platform2.4.0, 2.7.0, 2.7.1, 2.8.0, 2.9.0
  • Oracle Commerce Merchandising11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.3.1, 11.3.2
  • Oracle Financial Services Analytical Applications Infrastructure8.0.6 - 8.0.9, 8.1.0, 8.1.1
  • Oracle Jd Edwards Enterpriseone Tools- 9.2.6.0
  • Oracle Peoplesoft Enterprise Peopletools8.56, 8.57, 8.58

As listed in the NVD configuration data. Not a statement about your estate.

References