vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-32809

Arbitrary HTML injection vulnerability in ckeditor

MEDIUM
5.4
CVSS Score
Published: August 12, 2021 at 05:10 PM UTC
Updated: June 17, 2026 at 03:53 AM UTC
11 products affected across 3 vendorsFedoraPeopleSoft Enterprise PeopleToolsJD Edwards EnterpriseOne Tools

Using ckeditor4 by ckeditor?

Get instant alerts when new vulnerabilities affect ckeditor4 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.4
Exploit prediction
EPSS 1%

Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ckeditor· Ckeditordrupal
95%
4.5.2 ≤ v < 4.16.2
Affected range stops below 4.16.2, so it looks safe — our inference, not a vendor statement
Fedora· Fedora Projectrpm
95%
333435
Application Express· Oracledrupal
95%
v < 21.1.4
Affected range stops below 21.1.4, so it looks safe — our inference, not a vendor statement
Banking Party Management· Oracle
95%
2.7.0
Commerce Guided Search· Oracledrupal
95%
11.3.2
Commerce Merchandising· Oracledrupal
95%
11.3.2
Documaker· Oraclenpm
95%
12.6.312.6.4
Financial Services Analytical Applications Infrastructure· Oracledrupal
95%
8.0.7 ≤ v ≤ 8.1.1
JD Edwards EnterpriseOne Tools· Oracledrupal
95%
v < 9.2.6.0
Affected range stops below 9.2.6.0, so it looks safe — our inference, not a vendor statement
PeopleSoft Enterprise PeopleTools· Oracledrupal
95%
8.578.588.59

References (6)

x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://www.oracle.com/security-alerts/cpujan2022.html
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://www.oracle.com/security-alerts/cpuoct2021.html

CVSS

5.4MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-94CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card