CVE:CVE-2021-41165
CNNVD:CNNVD-202111-1559
CKEditor是一套开源的、基于网页的文字编辑器。
CKEditor 4 中存在跨站脚本漏洞，该漏洞源于产品未对输入数据的特殊字符做有效过滤。攻击者可通过该漏洞执行客户端代码。以下产品及版本受到影响： CKEditor4 4.17.0 之前版本。
solution:Upgrade ckeditor ckeditor to a higher version than 4.17.0,and avoid the version (,4.17.0); Upgrade drupal drupal to a higher version than 8.9.20,9.1.14,9.2.9,and avoid the version [8.9.0,8.9.20),[9.1.0,9.1.14),[9.2.0,9.2.9); Upgrade oracle agile_product_lifecycle_management to a higher version than 9.3.6,and avoid the version 9.3.6; Upgrade oracle application_express to a higher version than 22.1,and avoid the version (,22.1); Upgrade oracle banking_apis to a higher version than 18.3,19.1,19.2,20.1,21.1,and avoid the version [18.1,18.3],19.1,19.2,20.1,21.1; Upgrade oracle banking_digital_experience to a higher version than 18.3,19.1,19.2,20.1,21.1,and avoid the version [18.1,18.3],19.1,19.2,20.1,21.1; Upgrade oracle commerce_guided_search to a higher version than 11.3.2,and avoid the version 11.3.2; Upgrade oracle peoplesoft_enterprise_peopletools to a higher version than 8.58,8.59,and avoid the version 8.58,8.59; Upgrade oracle webcenter_portal to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0