The vulnerability of the Advanced Content Filter WYSIWYG-editor CKEditor module allows a violator to circumvent the existing policy regarding access restrictions for HTML elements.

🗓️ 19 Apr 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

CKEditor Advanced Content Filter vulnerability allows bypassing HTML element access restrictions.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: B2B API of IBM Sterling B2B Integrator vulnerable to multiple issues due to CKEditor	3 Jan 202315:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.10	29 Jul 202522:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	22 Jun 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator is affected by multiple vulnerabilities in CKEditor	4 Dec 202415:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS Next uses a CKEditor version affected by multiple vulnerabilities	17 Jan 202517:35	–	ibm
ATTACKERKB	CVE-2021-41164	17 Nov 202119:15	–	attackerkb
Circl	CVE-2021-41164	17 Nov 202122:21	–	circl
CNNVD	CKEditor 跨站脚本漏洞	17 Nov 202100:00	–	cnnvd
CNVD	CKEditor Cross-Site Scripting Vulnerability (CNVD-2021-93368)	18 Nov 202100:00	–	cnvd

Vulners

Node

oracle oracle_banking_digital_experienceMatch18.1

OR

oracle oracle_banking_digital_experienceMatch18.2

OR

oracle oracle_banking_digital_experienceMatch18.3

OR

oracle oracle_banking_digital_experienceMatch19.1

OR

oracle oracle_banking_digital_experienceMatch19.2

OR

oracle oracle_banking_digital_experienceMatch20.1

OR

oracle oracle_banking_digital_experienceMatch21.1

OR

oracle oracle_banking_apisRange18.1–18.3

OR

oracle oracle_banking_apisMatch19.1

OR

oracle oracle_banking_apisMatch19.2

OR

oracle oracle_banking_apisMatch20.1

OR

oracle oracle_banking_apisMatch21.1

OR

ckeditor ckeditorRange4.0–4.17.0

Source	Link
github	www.github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj
github	www.github.com/ckeditor/ckeditor4/blob/major/CHANGES.md
drupal	www.drupal.org/sa-core-2021-011
oracle	www.oracle.com/security-alerts/cpujan2022.html
web	www.web.nvd.nist.gov/view/vuln/detail

19 Apr 2022 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24.9

CVSS 35.4

EPSS0.01257

CKEditor Advanced Content Filter HTML elements access restrictions web page structure