CVE-2021-37695: ckeditor Cross-site Scripting
Vulnerability summary
CVE-2021-37695 is a high (CVSS 7.3) Cross-site Scripting vulnerability in ckeditor. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 12-08-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · NpmEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.32%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
0.00 pp
From 1.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle9 products
- application_express< 21.1.4
- banking_party_management2.7.0
- commerce_guided_search11.3.2
- commerce_merchandising11.3.2
- documaker12.6.3 | 12.6.4
Ubuntu4 products
- ckeditor< 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 | < 4.5.7+dfsg-2ubuntu0.18.04.1 | < 4.12.1+dfsg-1ubuntu0.1
- ckeditor3All versions (No fix recorded)
- ldap-account-managerAll versions (No fix recorded)
- request-tracker4All versions (No fix recorded)
Debian2 products
- ckeditor< 4.16.2+dfsg-1
- debian_linuxEOL9.0
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Npm1 product
- ckeditor4< 4.16.2
6 vendors · 19 products
References
18 links- github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhcX Refsource CONFIRMREPORTWEBThird Party Advisory
- github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58X Refsource MISCREPORTWEBPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
