CVE-2021-33829

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "vendor_product": "fedoraproject:fedora",
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "33"
                },
                {
                    "last_affected": "33"
                },
                {
                    "introduced": "34"
                },
                {
                    "last_affected": "34"
                },
                {
                    "introduced": "35"
                },
                {
                    "last_affected": "35"
                }
            ]
        }
    ]
}

References

Affected packages

Git

github.com/ckeditor/ckeditor4

Affected ranges

Type

GIT

Repo

https://github.com/ckeditor/ckeditor4

Events

Introduced

8a12b041718e05eeffb62a931d95995ac72cbe22

Fixed

cae20318d46745cc46c811da4e7d68b38ca32449

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.14.0"
        },
        {
            "fixed": "4.16.1"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-33829.json"

github.com/ckeditor/ckeditor4-releases

Affected ranges

Type

GIT

Repo

https://github.com/ckeditor/ckeditor4-releases

Events

Introduced

0d574568baeddda92f231681ea5aac4860dca4e4

Fixed

a0d9ddd4b80b3dcc1d1bc8c2acc2d43e4c96b660

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.14.0"
        },
        {
            "fixed": "4.16.1"
        }
    ]
}

Affected versions

standard/4.*

standard/4.14.0

standard/4.14.1

standard/4.15.0

standard/4.15.1

standard/4.16.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-33829.json"

github.com/drupal/drupal

Affected ranges

Type

GIT

Repo

https://github.com/drupal/drupal

Events

Introduced

a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70

Fixed

1667e06929722a8d913ef989cc00f70a38129d6d

Introduced

d62812dc17ce593beb2ccd4cdbee1a76c95e3fd7

Fixed

ac80ed0600b9437c5959d3293cdbc67be0b7d320

Introduced

5c6f14f762c9aef87cd2731818386f202ee8463c

Fixed

c1b981a183d874efbc3cd211373067b574c8f1cb

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.9.0"
        },
        {
            "fixed": "8.9.16"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.14"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.1.9"
        }
    ]
}

Affected versions

8.*

8.9.0

8.9.11

8.9.12

8.9.15

8.9.2

8.9.3

8.9.4

8.9.5

8.9.8

9.*

9.0.0

9.0.10

9.0.13

9.0.2

9.0.3

9.0.5

9.1.0

9.1.1

9.1.2

9.1.4

9.1.5

9.1.6

9.1.8

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-33829.json"