CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
77.4%
Debian LTS Advisory DLA-2813-1 [email protected]
https://www.debian.org/lts/security/ Utkarsh Gupta
November 09, 2021 https://wiki.debian.org/LTS
Package : ckeditor
Version : 4.5.7+dfsg-2+deb9u1
CVE ID : CVE-2021-33829 CVE-2021-37695
Debian Bug : 992290
CKEditor, an open source WYSIWYG HTML editor with rich content
support, which can be embedded into web pages, had two
vulnerabilites as follows:
CVE-2021-33829
A cross-site scripting (XSS) vulnerability in the HTML Data
Processor in CKEditor 4 allows remote attackers to inject
executable JavaScript code through a crafted comment because
--!> is mishandled.
CVE-2021-37695
A potential vulnerability has been discovered in CKEditor 4
Fake Objects package. The vulnerability allowed to inject
malformed Fake Objects HTML, which could result in executing
JavaScript code.
For Debian 9 stretch, these problems have been fixed in version
4.5.7+dfsg-2+deb9u1.
We recommend that you upgrade your ckeditor packages.
For the detailed security status of ckeditor please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ckeditor
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 9 | all | ckeditor | < 4.5.7+dfsg-2+deb9u1 | ckeditor_4.5.7+dfsg-2+deb9u1_all.deb |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
77.4%