NVD Vulnerability Detail

CVE-2021-33829

Summary	A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Publication Date	June 9, 2021, 9:15 p.m.
Registration Date	June 10, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:09 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:ckeditor:ckeditor::::::::		4.14.0			4.16.1

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser	Patch Release Notes Vendor Advisory
2	https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser	Patch Release Notes Vendor Advisory
3	https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html	Mailing List Third Party Advisory
4	https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html	Mailing List Third Party Advisory
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
11	https://www.drupal.org/sa-core-2021-003	Patch Third Party Advisory
12	https://www.drupal.org/sa-core-2021-003	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

CKEditor 4 におけるクロスサイトスクリプティングの脆弱性

Title	CKEditor 4 におけるクロスサイトスクリプティングの脆弱性
Summary	CKEditor 4 には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 7, 2021, midnight
Registration Date	Feb. 17, 2022, 2:29 p.m.
Last Update	Feb. 17, 2022, 2:29 p.m.

Affected System

Drupal

Debian

Debian GNU/Linux

Fedora Project

Fedora

CKEditor Team

CKEditor 4 4.14.0 以上 4.16.1 未満の 4.16.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-33829	https://www.cve.org/CVERecord?id=CVE-2021-33829
National Vulnerability Database (NVD)
2	CVE-2021-33829	https://nvd.nist.gov/vuln/detail/CVE-2021-33829

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
CKeditor
1	CKEditor 4.16.1 with accessibility enhancements (Improvements for comments in HTML parser)	https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser
Debian
2	[SECURITY] [DLA 2813-1] ckeditor security update	https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
Fedora Update Notification
3	FEDORA-2021-51457da891	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
4	FEDORA-2021-72176a63a8	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
5	FEDORA-2021-87578dca12	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
Security advisories
6	SA-CORE-2021-003	https://www.drupal.org/sa-core-2021-003

Change Log

No	Changed Details	Date of change
1	[2022年02月17日] 掲載	Feb. 17, 2022, 2:29 p.m.