Is CVE-2021-37695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-37695 being exploited in the wild.

How severe is CVE-2021-37695?

Low severity, with a CVSS score of 3.1, published 23 August 2021.

Which products and versions are affected?

ckeditor4 (npm) SEMVER:introduced=0,fixed=4.16.2.

Is there a fix for CVE-2021-37695?

Yes. ckeditor4 (npm): upgrade to 4.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-37695 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-37695?

Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-37695: CKEditor 4 Fake Objects cross-site scripting via malformed HTML

CVE-2021-37695 · Severity: low · CVSS 3.1 · Published 2021-08-23

CKEditor 4 is a popular rich text editor used in web applications to allow users to create and edit formatted content. The Fake Objects plugin in CKEditor 4, which is used by several dependent plugins, contains a cross-site scripting vulnerability that allows attackers to inject and execute malicious JavaScript code by crafting specially malformed HTML. This could allow attackers to steal user session data, modify page content, or perform actions on behalf of authenticated users.

Technologies: ckeditor4 (npm). Vendors: npm.

Quick answers

Is CVE-2021-37695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-37695 being exploited in the wild.
How severe is CVE-2021-37695?: Low severity, with a CVSS score of 3.1, published 23 August 2021.
Which products and versions are affected?: ckeditor4 (npm) SEMVER:introduced=0,fixed=4.16.2.
Is there a fix for CVE-2021-37695?: Yes. ckeditor4 (npm): upgrade to 4.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-37695 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-37695?: Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ckeditor4 (npm): upgrade to 4.16.2 or later
```
npm install ckeditor4@4.16.2
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the Fake Objects plugin (CWE-79) that occurs when processing malformed HTML in fake object elements. The vulnerability allows injection of JavaScript code through specially crafted HTML that bypasses the plugin's sanitization logic. Attack requires user interaction (the victim must be using an affected CKEditor 4 plugin instance with user input) and network access to a vulnerable application. An attacker can execute arbitrary JavaScript in the context of the editor user's browser, potentially accessing sensitive data or performing unauthorized actions. The vulnerability affects CKEditor 4 versions prior to 4.16.2, which was released as a patch in August 2021.

Affected products

CKSource CKEditor 4 < 4.16.2

Identifiers

CVE-2021-37695
GHSA-m94c-37g6-cjhc

Timeline

2021-08-12: disclosed
2021-08-23: patched: Version 4.16.2 released

References

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.