Skip to content

Commit 0435b90

Browse files
jamgregorypostmodern
jamgregory
authored and
postmodern
committed
Added a number of CKEditor 4 vulnerabilities that are not reported by Bundler Audit
1 parent aaeeaee commit 0435b90

16 files changed

+562
-0
lines changed

‎gems/ckeditor/CVE-2020-27193.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
gem: ckeditor
3+
cve: 2020-27193
4+
ghsa: 4m44-5j2g-xf64
5+
url: https://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/
6+
title: Improper Neutralization of Input During Web Page Generation in CKEditor4
7+
date: 2022-05-24
8+
description: |
9+
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin
10+
for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading
11+
a user to copy and paste crafted HTML code into one of editor inputs.
12+
cvss_v3: 6.1
13+
patched_versions:
14+
- ">= 5.1.2"
15+
related:
16+
url:
17+
- https://nvd.nist.gov/vuln/detail/CVE-2020-27193
18+
- https://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/
19+
- https://ckeditor.com/cke4/release/CKEditor-4.15.1
20+
- https://ckeditor.com/ckeditor-4/download/
21+
- https://www.oracle.com//security-alerts/cpujul2021.html
22+
- https://www.oracle.com/security-alerts/cpuApr2021.html
23+
- https://www.oracle.com/security-alerts/cpuoct2021.html
24+
- https://github.com/advisories/GHSA-4m44-5j2g-xf64

‎gems/ckeditor/CVE-2020-9281.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
gem: ckeditor
3+
cve: 2020-9281
4+
ghsa: vcjf-mgcg-jxjq
5+
url: https://github.com/ckeditor/ckeditor4
6+
title: CKEditor 4.0 vulnerability in the HTML Data Processor
7+
date: 2021-05-07
8+
description: |
9+
A cross-site scripting (XSS) vulnerability in the HTML Data Processor
10+
for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script
11+
through a crafted "protected" comment (with the cke_protected syntax).
12+
cvss_v3: 6.1
13+
patched_versions:
14+
- ">= 5.1.2"
15+
related:
16+
url:
17+
- https://nvd.nist.gov/vuln/detail/CVE-2020-9281
18+
- https://github.com/ckeditor/ckeditor4
19+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/
20+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/
21+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/
22+
- https://www.oracle.com/security-alerts/cpujan2021.html
23+
- https://www.oracle.com/security-alerts/cpuoct2020.html
24+
- https://www.oracle.com/security-alerts/cpuApr2021.html
25+
- https://www.oracle.com/security-alerts/cpuoct2021.html
26+
- https://www.oracle.com/security-alerts/cpujan2022.html
27+
- https://github.com/advisories/GHSA-vcjf-mgcg-jxjq

‎gems/ckeditor/CVE-2021-26271.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-26271
4+
ghsa: f6rf-9m92-x2hh
5+
url: https://github.com/ckeditor/ckeditor4/blob/master/CHANGES.md#ckeditor-416
6+
title: Regular expression Denial of Service in dialog plugin
7+
date: 2021-01-26
8+
description: |
9+
## Affected packages
10+
11+
The vulnerability has been discovered and fixed in the [dialog](https://ckeditor.com/cke4/addon/dialog) plugin. Packages indirectly affected by the issue having dialog plugin dependency:
12+
13+
- [Link](https://ckeditor.com/cke4/addon/link)
14+
- [Image](https://ckeditor.com/cke4/addon/image)
15+
- [Enhanced Image](https://ckeditor.com/cke4/addon/image2)
16+
- [Code Snippet](https://ckeditor.com/cke4/addon/codesnippet)
17+
- [Iframe Dialog](https://ckeditor.com/cke4/addon/iframe)
18+
19+
## Impact
20+
21+
A potential vulnerability has been discovered in CKEditor 4 dialog plugin. The vulnerability allowed to abuse a dialog input validator regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 4 plugins listed above at version < 4.18.0.
22+
23+
## Patches
24+
25+
The problem has been recognized and patched. The fix will be available in version 4.18.0.
26+
27+
## For more information
28+
29+
Email us at security@cksource.com if you have any questions or comments about this advisory.
30+
31+
## Acknowledgements
32+
33+
This issue was discovered by the CKEditor 4 team during our regular security audit.
34+
patched_versions:
35+
- ">= 5.1.2"
36+
cvss_v3: 6.5
37+
related:
38+
url:
39+
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416
40+
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh

‎gems/ckeditor/CVE-2021-26272.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-26272
4+
ghsa: wpvm-wqr4-p7cw
5+
url: https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first
6+
title: Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
7+
date: 2021-10-13
8+
description: |
9+
It was possible to execute a ReDoS-type attack inside CKEditor 4 before
10+
4.16 by persuading a victim to paste crafted URL-like text into the editor, and
11+
then press Enter or Space (in the Autolink plugin).
12+
cvss_v3: 6.5
13+
patched_versions:
14+
- ">= 5.1.2"
15+
related:
16+
url:
17+
- https://nvd.nist.gov/vuln/detail/CVE-2021-26272
18+
- https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first
19+
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416
20+
- https://www.oracle.com//security-alerts/cpujul2021.html
21+
- https://www.oracle.com/security-alerts/cpuoct2021.html
22+
- https://www.oracle.com/security-alerts/cpujan2022.html
23+
- https://github.com/advisories/GHSA-wpvm-wqr4-p7cw

‎gems/ckeditor/CVE-2021-32808.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-32808
4+
ghsa: 6226-h7ff-ch6c
5+
url: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c
6+
title: Widget feature vulnerability allowing to execute JavaScript code using undo
7+
functionality
8+
date: 2021-08-23
9+
description: |
10+
### Affected packages
11+
The vulnerability has been discovered in [Widget](https://ckeditor.com/cke4/addon/clipboard) plugin if used alongside [Undo](https://ckeditor.com/cke4/addon/undo) feature.
12+
13+
### Impact
14+
A potential vulnerability has been discovered in CKEditor 4 [Widget](https://ckeditor.com/cke4/addon/widget) package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0.
15+
16+
### Patches
17+
The problem has been recognized and patched. The fix will be available in version 4.16.2.
18+
19+
### For more information
20+
Email us at security@cksource.com if you have any questions or comments about this advisory.
21+
22+
### Acknowledgements
23+
The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability.
24+
cvss_v3: 7.6
25+
unaffected_versions:
26+
- "< 5.1.2"
27+
patched_versions:
28+
- ">= 5.1.2"
29+
related:
30+
url:
31+
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c
32+
- https://nvd.nist.gov/vuln/detail/CVE-2021-32808
33+
- https://github.com/ckeditor/ckeditor4/releases/tag/4.16.2
34+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
35+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
36+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
37+
- https://www.oracle.com/security-alerts/cpuoct2021.html
38+
- https://www.oracle.com/security-alerts/cpujan2022.html
39+
- https://github.com/advisories/GHSA-6226-h7ff-ch6c

‎gems/ckeditor/CVE-2021-32809.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-32809
4+
ghsa: 7889-rm5j-hpgg
5+
url: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg
6+
title: Clipboard feature vulnerability allowing to inject arbitrary HTML into the
7+
editor using paste functionality
8+
date: 2021-08-23
9+
description: |
10+
### Affected packages
11+
The vulnerability has been discovered in [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin. All plugins with [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin dependency are affected:
12+
13+
* [clipboard](https://ckeditor.com/cke4/addon/clipboard)
14+
* [pastetext](https://ckeditor.com/cke4/addon/pastetext)
15+
* [pastetools](https://ckeditor.com/cke4/addon/pastetools)
16+
* [widget](https://ckeditor.com/cke4/addon/widget)
17+
* [uploadwidget](https://ckeditor.com/cke4/addon/uploadwidget)
18+
* [autolink](https://ckeditor.com/cke4/addon/autolink)
19+
* [tableselection](https://ckeditor.com/cke4/addon/tableselection)
20+
21+
### Impact
22+
A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2.
23+
24+
### Patches
25+
The problem has been recognized and patched. The fix will be available in version 4.16.2.
26+
27+
### For more information
28+
Email us at security@cksource.com if you have any questions or comments about this advisory.
29+
30+
### Acknowledgements
31+
The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability.
32+
cvss_v3: 4.6
33+
unaffected_versions:
34+
- "< 4.1.2"
35+
patched_versions:
36+
- ">= 5.1.2"
37+
related:
38+
url:
39+
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg
40+
- https://nvd.nist.gov/vuln/detail/CVE-2021-32809
41+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
42+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
43+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
44+
- https://www.oracle.com/security-alerts/cpuoct2021.html
45+
- https://www.oracle.com/security-alerts/cpujan2022.html
46+
- https://github.com/advisories/GHSA-7889-rm5j-hpgg

‎gems/ckeditor/CVE-2021-33829.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-33829
4+
ghsa: rgx6-rjj4-c388
5+
url: https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser
6+
title: ckeditor4 vulnerable to cross-site scripting
7+
date: 2021-06-21
8+
description: |
9+
A cross-site scripting (XSS) vulnerability in the HTML Data Processor
10+
in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject
11+
executable JavaScript code through a crafted comment because `--!>` is mishandled.
12+
cvss_v3: 6.1
13+
unaffected_versions:
14+
- "< 5.1.1"
15+
patched_versions:
16+
- ">= 5.1.2"
17+
related:
18+
url:
19+
- https://nvd.nist.gov/vuln/detail/CVE-2021-33829
20+
- https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser
21+
- https://www.npmjs.com/package/ckeditor4
22+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
23+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
24+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
25+
- https://www.drupal.org/sa-core-2021-003
26+
- https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
27+
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2021-33829.yaml
28+
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2021-33829.yaml
29+
- https://github.com/advisories/GHSA-rgx6-rjj4-c388

‎gems/ckeditor/CVE-2021-37695.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-37695
4+
ghsa: m94c-37g6-cjhc
5+
url: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc
6+
title: Fake objects feature vulnerability allowing to execute JavaScript code using
7+
malformed HTML.
8+
date: 2021-08-23
9+
description: |
10+
### Affected packages
11+
The vulnerability has been discovered in [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin. All plugins with [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin dependency are affected:
12+
13+
* [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)
14+
* [Link](https://ckeditor.com/cke4/addon/link)
15+
* [Flash](https://ckeditor.com/cke4/addon/flash)
16+
* [Iframe](https://ckeditor.com/cke4/addon/iframe)
17+
* [Forms](https://ckeditor.com/cke4/addon/forms)
18+
* [Page Break](https://ckeditor.com/cke4/addon/pagebreak)
19+
20+
### Impact
21+
A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.
22+
23+
### Patches
24+
The problem has been recognized and patched. The fix will be available in version 4.16.2.
25+
26+
### For more information
27+
Email us at security@cksource.com if you have any questions or comments about this advisory.
28+
29+
### Acknowledgements
30+
The CKEditor 4 team would like to thank Mika Kulmala ([kulmik](https://github.com/kulmik)) for recognizing and reporting this vulnerability.
31+
cvss_v3: 7.3
32+
patched_versions:
33+
- ">= 5.1.2"
34+
related:
35+
url:
36+
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc
37+
- https://nvd.nist.gov/vuln/detail/CVE-2021-37695
38+
- https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58
39+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
40+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
41+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
42+
- https://www.oracle.com/security-alerts/cpuoct2021.html
43+
- https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
44+
- https://www.oracle.com/security-alerts/cpujan2022.html
45+
- https://github.com/advisories/GHSA-m94c-37g6-cjhc

‎gems/ckeditor/CVE-2021-41164.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-41164
4+
ghsa: pvmx-g8h5-cprj
5+
url: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj
6+
title: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript
7+
code using malformed HTML
8+
date: 2021-11-17
9+
description: |
10+
### Affected packages
11+
The vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.
12+
13+
### Impact
14+
A potential vulnerability has been discovered in CKEditor 4 Advanced Content Filter (ACF) core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.
15+
16+
### Patches
17+
The problem has been recognized and patched. The fix will be available in version 4.17.0.
18+
19+
### For more information
20+
Email us at security@cksource.com if you have any questions or comments about this advisory.
21+
22+
### Acknowledgements
23+
The CKEditor 4 team would like to thank Maurice Dauer ([laytonctf](https://twitter.com/laytonctf)) for recognizing and reporting this vulnerability.
24+
cvss_v3: 8.2
25+
patched_versions:
26+
- ">= 5.1.2"
27+
related:
28+
url:
29+
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj
30+
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417
31+
- https://nvd.nist.gov/vuln/detail/CVE-2021-41164
32+
- https://www.drupal.org/sa-core-2021-011
33+
- https://www.oracle.com/security-alerts/cpujan2022.html
34+
- https://www.oracle.com/security-alerts/cpuapr2022.html
35+
- https://www.oracle.com/security-alerts/cpujul2022.html
36+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
37+
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
38+
- https://github.com/advisories/GHSA-pvmx-g8h5-cprj

‎gems/ckeditor/CVE-2021-41165.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
gem: ckeditor
3+
cve: 2021-41165
4+
ghsa: 7h26-63m7-qhf2
5+
url: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2
6+
title: HTML comments vulnerability allowing to execute JavaScript code
7+
date: 2021-11-17
8+
description: |
9+
### Affected packages
10+
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.
11+
12+
### Impact
13+
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.
14+
15+
### Patches
16+
The problem has been recognized and patched. The fix will be available in version 4.17.0.
17+
18+
### For more information
19+
Email us at security@cksource.com if you have any questions or comments about this advisory.
20+
21+
### Acknowledgements
22+
The CKEditor 4 team would like to thank William Bowling ([wbowling](https://github.com/wbowling)) for recognizing and reporting this vulnerability.
23+
cvss_v3: 8.2
24+
patched_versions:
25+
- ">= 5.1.2"
26+
related:
27+
url:
28+
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2
29+
- https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417
30+
- https://nvd.nist.gov/vuln/detail/CVE-2021-41165
31+
- https://www.drupal.org/sa-core-2021-011
32+
- https://www.oracle.com/security-alerts/cpujan2022.html
33+
- https://www.oracle.com/security-alerts/cpuapr2022.html
34+
- https://www.oracle.com/security-alerts/cpujul2022.html
35+
- https://github.com/advisories/GHSA-7h26-63m7-qhf2

0 commit comments

Comments
 (0)