Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW05NGMtMzdnNi1jamhj

Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.

Affected packages

The vulnerability has been discovered in Fake Objects plugin. All plugins with Fake Objects plugin dependency are affected:

• Fake Objects
• Link
• Flash
• Iframe
• Forms
• Page Break

Impact

A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.

Patches

The problem has been recognized and patched. The fix will be available in version 4.16.2.

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

Acknowledgements

The CKEditor 4 team would like to thank Mika Kulmala (kulmik) for recognizing and reporting this vulnerability.

Permalink: https://github.com/advisories/GHSA-m94c-37g6-cjhc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW05NGMtMzdnNi1jamhj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Identifiers: GHSA-m94c-37g6-cjhc, CVE-2021-37695
References:

• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc
• https://nvd.nist.gov/vuln/detail/CVE-2021-37695
• https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58
• https://lists.fedoraproject.org/archives/list/[email protected]/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://github.com/advisories/GHSA-m94c-37g6-cjhc

Repository: https://github.com/ckeditor/ckeditor4
Blast Radius: 20.0

Affected Packages