CVE-2020-9281

Fixed in a distro release EPSS 4%

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Published 2020-03-07 · CVE record · OSV

Products: ckeditor, fedoraproject fedora, drupal, oracle agile_product_lifecycle_management, oracle application_express, oracle jd_edwards_enterpriseone_tools, oracle peoplesoft_enterprise_peopletools, oracle siebel_apps_-_customer_order_management, oracle webcenter_portal, oracle banking_enterprise_default_management, oracle banking_enterprise_default_managment

Fixed upstream

Distro releases