CVE-2021-32809

Publication date 12 August 2021

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.4 · Medium

Score breakdown

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Status

Package Ubuntu Release Status
ckeditor 22.04 LTS jammy
Not affected
21.10 impish
Fixed 4.16.0+dfsg-2ubuntu0.1
21.04 hirsute Ignored end of life
20.04 LTS focal
Fixed 4.12.1+dfsg-1ubuntu0.1
18.04 LTS bionic
Fixed 4.5.7+dfsg-2ubuntu0.18.04.1
16.04 LTS xenial
14.04 LTS trusty Not in release

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Severity score breakdown

Parameter Value
Base score 5.4 · Medium
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Scope Changed
Confidentiality Low
Integrity impact Low
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-5340-1
    • CKEditor vulnerabilities
    • 22 March 2022
    • USN-5340-2
    • CKEditor vulnerabilities
    • 23 March 2022

Other references