NexaPulse
Subscribe
6.1mediumMedium

CVE-2020-9281

Ckeditor Ckeditor

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, someone has to be persuaded to take an action first.

Scoring

CVSS
6.1 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Assigned by
cve@mitre.org

Dates

Published
2020-03-07
Last modified
2026-08-25
Sources
NVD

Affected products

  • Ckeditor Ckeditor4.0 - 4.14
  • Fedoraproject Fedora30, 31, 32
  • Drupal Drupal8.7.0 - 8.7.12, 8.8.0 - 8.8.4
  • Oracle Agile Product Lifecycle Management9.3.5, 9.3.6
  • Oracle Application Express- 20.2
  • Oracle Jd Edwards Enterpriseone Tools- 9.2.5.2
  • Oracle Peoplesoft Enterprise Peopletoolsall versions, 8.56, 8.57, 8.58
  • Oracle Siebel Apps - Customer Order Management- 21.0
  • Oracle Webcenter Portal11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
  • Oracle Banking Enterprise Default Management2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
  • Oracle Banking Enterprise Default Managment2.3.0 - 2.4.0

As listed in the NVD configuration data. Not a statement about your estate.

References