Description

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Remediation

References

CVE-2021-26272

Related Vulnerabilities

WordPress Plugin Google +1 by BestWebSoft Cross-Site Scripting (1.1.6)

WordPress Plugin Photo Gallery, Images, Slider in Rbs Image Gallery Unspecified Vulnerability (2.0.18)

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-2817)

Apache Traffic Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9515)

Plone CMS Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-33511)

Severity

Medium

Classification

CVE-2021-26272 CWE-829 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities