Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
Summary
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
Original description
The description as published by the source.
Affected packages
The vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.
Impact
A potential vulnerability has been discovered in CKEditor 4 Advanced Content Filter (ACF) core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.
Patches
The problem has been recognized and patched. The fix will be available in version 4.17.0.
For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.
Acknowledgements
The CKEditor 4 team would like to thank Maurice Dauer (laytonctf) for recognizing and reporting this vulnerability.
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
CKEditor4のAdvanced Content Filter（ACF）モジュールに脆弱性が発見されました。この問題は、バージョン4.17.0未満の利用者に影響を及ぼし、コンテンツの不正なHTMLを注入してJavaScriptコードを実行させる可能性があります。この脆弱性は既に認識され、バージョン4.17.0で修正されています。
CKEditor4のACFモジュールにおける不正なHTML注入の脆弱性。
CKEditor4のバージョン4.17.0未満のすべてのユーザー。
この脆弱性により、不正なHTMLを通じてJavaScriptコードが実行される可能性があるため、非常に重要です。
バージョン4.17.0にアップデートしてください。
情報なし
CKEditor4のバージョン番号を確認して、4.17.0未満である場合は影響を受けている可能性があります。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2021-41164 ckeditor
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web drupal.org
- web oracle.com
- web oracle.com
- web oracle.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org