CVE:CVE-2021-41164
CNNVD:CNNVD-202111-1552
CKEditor是一套开源的、基于网页的文字编辑器。
CKEditor 4 存在跨站脚本漏洞，该漏洞允许攻击者绕过内容清理注入格式错误的 HTML，这可能会导致执行 JavaScript 代码。
solution:Upgrade ckeditor ckeditor to a higher version than 4.17.0,and avoid the version [4.0,4.17.0); Upgrade drupal drupal to a higher version than 8.9.20,9.1.14,9.2.9,and avoid the version [8.9.0,8.9.20),[9.1.0,9.1.14),[9.2.0,9.2.9); Upgrade oracle banking_apis to a higher version than 18.3,19.1,19.2,20.1,21.1,and avoid the version [18.1,18.3],19.1,19.2,20.1,21.1; Upgrade oracle banking_digital_experience to a higher version than 18.3,19.1,19.2,20.1,21.1,and avoid the version [18.1,18.3],19.1,19.2,20.1,21.1; Upgrade oracle agile_plm to a higher version than 9.3.6,and avoid the version 9.3.6; Upgrade oracle application_express to a higher version than 22.1,and avoid the version (,22.1); Upgrade oracle commerce_guided_search to a higher version than 11.3.2,and avoid the version 11.3.2; Upgrade oracle peoplesoft_enterprise_peopletools to a higher version than 8.58,8.59,and avoid the version 8.58,8.59; Upgrade oracle webcenter_portal to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade fedoraproject fedora to a higher version than 36,37,and avoid the version 36,37