CVE-2021-26272 Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
Attackers can cause a denial of service in CKEditor by tricking users into pasting crafted text that triggers excessive processing in the Autolink plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-26272?
CVE-2021-26272 is a medium-severity denial of service vulnerability in Oracle Agile Product Lifecycle Management, published on 26 Jan 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Weakness: CWE-829
Which versions are affected by CVE-2021-26272?
2 open source packages ship an affected version, including ckeditor4. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
ckeditor4 npm | All versions | 4.16.0 |
ckeditor4 npm | All versions | 4.16.0 |
Products include Ckeditor Ckeditor, Oracle Agile Product Lifecycle Management, Oracle Application Express, Oracle Banking Party Management, Oracle Commerce Merchandising, Oracle Financial Services Analytical Applications Infrastructure and 4 more.
How do I fix CVE-2021-26272?
Upgrade ckeditor4 to 4.16.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-26272 being exploited?
There is no known exploitation of CVE-2021-26272 in the wild and no public exploit code.
Other vulnerabilities in Oracle Agile Product Lifecycle Management
- CVE-2023-31541 File upload in n/a
- CVE-2021-41164 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
- CVE-2021-41165 HTML comments vulnerability allowing to execute JavaScript code
- CVE-2021-32808 Cross-site scripting in ckeditor via abuse of undo functionality
- CVE-2011-4972 Missing authorization in CKEditor Drupal module
All Oracle Agile Product Lifecycle Management vulnerabilities
Sources
Also known as DEBIAN-CVE-2021-26272, GHSA-wpvm-wqr4-p7cw, UBUNTU-CVE-2021-26272.