CVE:CVE-2021-26272
CNNVD:CNNVD-202101-2220
CKEditor是一套开源的、基于网页的文字编辑器。
CKEditor 4.16之前版本存在安全漏洞，通过诱导受害者将经过编辑的类似url的文本粘贴到编辑器中，然后按回车或空格(在Autolink插件中)触发此漏洞。
solution:Upgrade ckeditor ckeditor to a higher version than 4.16,and avoid the version [4.0,4.16); Upgrade oracle agile_plm to a higher version than 9.3.5,9.3.6,and avoid the version 9.3.5,9.3.6; Upgrade oracle application_express to a higher version than 21.1.0,and avoid the version (,21.1.0); Upgrade oracle banking_party_management to a higher version than 2.7.0,and avoid the version 2.7.0; Upgrade oracle commerce_merchandising to a higher version than 11.3.2,11.1.0,11.2.0,and avoid the version [11.3.0,11.3.2],11.1.0,11.2.0; Upgrade oracle financial_services_analytical_applications_infrastructure to a higher version than 8.0.9,8.1.0,8.1.1,and avoid the version [8.0.6,8.0.9],8.1.0,8.1.1; Upgrade oracle financial_services_model_management_and_governance to a higher version than 8.1.0.0.0,and avoid the version [8.0.8.0.0,8.1.0.0.0]; Upgrade oracle jd_edwards_enterpriseone_tools to a higher version than 9.2.6.0,and avoid the version (,9.2.6.0); Upgrade oracle siebel_ui_framework to a higher version than 21.9,and avoid the version (,21.9]; Upgrade oracle webcenter_sites to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0