{"id":"CVE-2021-37695","details":"ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version \u003c 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.","aliases":["GHSA-m94c-37g6-cjhc"],"modified":"2026-07-07T08:50:53.909256304Z","published":"2021-08-13T00:15:07.397Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"21.1.4"}],"source":"CPE_RANGE","vendor_product":"oracle:application_express"},{"vendor_product":"oracle:financial_services_analytical_applications_infrastructure","cpes":["cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.7"},{"last_affected":"8.1.1"}],"source":"CPE_RANGE"},{"extracted_events":[{"introduced":"8.0.8.0.0"},{"last_affected":"8.1.0.0.0"}],"source":"CPE_RANGE","vendor_product":"oracle:financial_services_model_management_and_governance","cpes":["cpe:2.3:a:oracle:financial_services_model_management_and_governance:*:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"9.2.6.0"}],"source":"CPE_RANGE","vendor_product":"oracle:jd_edwards_enterpriseone_tools"},{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"33"},{"last_affected":"33"},{"introduced":"34"},{"last_affected":"34"},{"introduced":"35"},{"last_affected":"35"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"},{"vendor_product":"oracle:banking_party_management","cpes":["cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.7.0"},{"last_affected":"2.7.0"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"11.3.2"},{"last_affected":"11.3.2"}],"source":"CPE_STRING","vendor_product":"oracle:commerce_guided_search","cpes":["cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.3.2"},{"last_affected":"11.3.2"}],"source":"CPE_STRING","vendor_product":"oracle:commerce_merchandising"},{"source":"CPE_STRING","vendor_product":"oracle:documaker","cpes":["cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.6.3"},{"last_affected":"12.6.3"},{"introduced":"12.6.4"},{"last_affected":"12.6.4"}]},{"vendor_product":"oracle:financial_services_analytical_applications_infrastructure","cpes":["cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.3"},{"last_affected":"8.0.3"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"8.57"},{"last_affected":"8.57"},{"introduced":"8.58"},{"last_affected":"8.58"},{"introduced":"8.59"},{"last_affected":"8.59"}],"source":"CPE_STRING","vendor_product":"oracle:peoplesoft_enterprise_peopletools","cpes":["cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/"},{"type":"ADVISORY","url":"https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html"},{"type":"FIX","url":"https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ckeditor/ckeditor4","events":[{"introduced":"0"},{"fixed":"4e64f672190a14d3c38aebd94ae4fb10c79e4545"},{"fixed":"de3c001540715f9c3801aaa38a1917de46cfcf58"}],"database_specific":{"cpe":"cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.16.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["4.16.1","4.15.1","4.14.1","4.13.1","4.12.1","4.7.2","4.11.4","4.11.3","4.11.2","4.11.1","4.10.1","4.9.2","4.9.1","4.7.3","4.7.1","4.6.2","4.6.1","4.5.11","4.5.10","4.5.9","4.5.8","4.5.7","4.5.6","4.5.5","4.5.4","4.5.3","4.5.2","4.5.1","4.5.0","4.5.0-beta","4.4.1","4.4.0","4.2.3","4.2.2","4.2.1","4.2.0","4.2","4.1.0","4.1","4.1rc","4.0.1","4.0.0","4.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-37695.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ckeditor/ckeditor4-releases","events":[{"introduced":"0"},{"fixed":"0919c6a34271f9776c495e78deff75ffefe52b62"}],"database_specific":{"cpe":"cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.16.2"}],"source":"CPE_RANGE"}}],"versions":["standard/4.16.1","standard/4.16.0","standard/4.15.1","standard/4.15.0","standard/4.14.1","standard/4.14.0","standard/4.13.1","standard/4.13.0","standard/4.12.1","standard/4.12.0","standard/4.11.4","standard/4.11.3","standard/4.11.2","standard/4.11.1","standard/4.11.0","standard/4.10.1","standard/4.10.0","standard/4.9.2","standard/4.9.1","standard/4.9.0","standard/4.8.0","standard/4.7.3","standard/4.7.2","standard/4.7.1","standard/4.7.0","standard/4.6.2","standard/4.6.1","standard/4.6.0","standard/4.5.11","standard/4.5.10","standard/4.5.9","standard/4.5.8","standard/4.5.7","standard/4.5.6","standard/4.5.5","standard/4.5.4","standard/4.5.3","standard/4.5.2","standard/4.5.1","standard/4.5.0","standard/4.4.8","standard/4.4.7","standard/4.4.6","standard/4.4.5","standard/4.4.4","standard/4.4.3","standard/4.4.2","standard/4.4.1","standard/4.4.0","standard/4.3.5","standard/4.3.4","standard/4.3.3","4.3.2/standard","4.3.1/standard","4.3.0/standard","4.2.3/standard","4.2.2/standard","4.2.1/standard","4.2/standard","4.1.3/standard","4.1.2/standard","4.1.1/standard","4.1/standard","4.1rc/standard","4.0.1/standard","4.0/standard"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-37695.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}