NexaPulse
Subscribe
6.5mediumMedium

CVE-2021-26271

Ckeditor Ckeditor

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, someone has to be persuaded to take an action first.

Scoring

CVSS
6.5 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-829
Assigned by
cve@mitre.org

Dates

Published
2021-01-26
Last modified
2026-08-25
Sources
NVD

Affected products

  • Ckeditor Ckeditor4.0 - 4.16
  • Oracle Agile Product Lifecycle Management9.3.5, 9.3.6
  • Oracle Application Express- 21.1.0
  • Oracle Financial Services Analytical Applications Infrastructure8.0.6 - 8.0.9, 8.1.0, 8.1.1
  • Oracle Jd Edwards Enterpriseone Tools- 9.2.6.0
  • Oracle Siebel Ui Framework- 21.9
  • Oracle Webcenter Sites12.2.1.3.0, 12.2.1.4.0

As listed in the NVD configuration data. Not a statement about your estate.

References