CVE-2021-32809 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-32809 PUBLISHED

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

EPSS 0.32% · 55.0th percentile

Risk Scores

EPSS Score

0.32%

55.0th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:20.04:LTS	ckeditor	0, 4.12.1+dfsg-1, 4.11.1+dfsg-1
Ubuntu:18.04:LTS	ckeditor	0, 4.5.7+dfsg-2
Ubuntu:Pro:16.04:LTS	ckeditor	0, 4.4.4+dfsg1-3, 4.5.7+dfsg-1

Timeline

Aug 12, 2021 CVE Published
Aug 12, 2021 PoC Published
Aug 13, 2021 EPSS Score
Oct 5, 2021 EPSS Score
Oct 10, 2021 EPSS Score
Dec 7, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 3, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 2, 2022 EPSS Score
May 30, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2021-32809 third-party-advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg third-party-advisory
https://ubuntu.com/security/notices/USN-5340-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2021-32809 third-party-advisory
https://ubuntu.com/security/notices/USN-5340-2 vendor-advisory

Open in Interactive Console →