Is CVE-2021-32809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-32809 being exploited in the wild.

How severe is CVE-2021-32809?

Low severity, with a CVSS score of 3.1, published 23 August 2021.

Which products and versions are affected?

ckeditor4 (npm) SEMVER:introduced=4.5.2,fixed=4.16.2.

Is there a fix for CVE-2021-32809?

Yes. ckeditor4 (npm): upgrade to 4.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-32809 attacked?

It is attacked over the network.

Am I affected by CVE-2021-32809?

Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32809: CKEditor 4 arbitrary HTML injection via clipboard paste

CVE-2021-32809 · Severity: low · CVSS 3.1 · Published 2021-08-23

CKEditor 4 is a popular rich-text editor used in web applications to allow users to create and edit formatted content. A vulnerability in its clipboard plugin allows an attacker to inject malicious HTML code into the editor by crafting a malformed paste operation, potentially leading to stored cross-site scripting (XSS) attacks if the content is later published or displayed to other users.

Technologies: ckeditor4 (npm). Vendors: npm.

Quick answers

Is CVE-2021-32809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-32809 being exploited in the wild.
How severe is CVE-2021-32809?: Low severity, with a CVSS score of 3.1, published 23 August 2021.
Which products and versions are affected?: ckeditor4 (npm) SEMVER:introduced=4.5.2,fixed=4.16.2.
Is there a fix for CVE-2021-32809?: Yes. ckeditor4 (npm): upgrade to 4.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32809 attacked?: It is attacked over the network.
Am I affected by CVE-2021-32809?: Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ckeditor4 (npm): upgrade to 4.16.2 or later
```
npm install ckeditor4@4.16.2
```

Technical details

The vulnerability exists in the CKEditor 4 clipboard plugin and affects all dependent plugins (pastetext, pastetools, widget, uploadwidget, autolink, tableselection). The issue is a cross-site scripting (CWE-79) and code injection (CWE-94) flaw that allows abuse of the paste functionality with malformed HTML. An attacker with network access can craft malformed HTML that, when pasted into the editor, bypasses sanitization and injects arbitrary HTML content. This typically requires user interaction (pasting content) but can result in persistent XSS if the injected HTML is stored and rendered elsewhere. The vulnerability affects CKEditor 4 versions 4.5.2 and later, and was patched in version 4.16.2.

Affected products

CKSource CKEditor 4 4.5.2 to 4.16.1

Identifiers

CVE-2021-32809
GHSA-7889-rm5j-hpgg

Timeline

2021-08-12: disclosed: CVE-2021-32809 published on NVD
2021-08-23: disclosed: GHSA-7889-rm5j-hpgg published
2021: patched: Fix available in version 4.16.2

References

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.