CVE:CVE-2020-9281
CNNVD:CNNVD-202003-260
CKEditor是一套开源的、基于网页的文字编辑器。HTML Data Processor是其中的一个HTML数据处理器。
CKEditor 4.14之前的4.0版本中的HTML Data Processor存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade ckeditor ckeditor to a higher version than 4.14,and avoid the version [4.0,4.14); Upgrade fedoraproject fedora to a higher version than 30,31,32,and avoid the version 30,31,32; Upgrade drupal drupal to a higher version than 8.7.12,8.8.4,and avoid the version [8.7.0,8.7.12),[8.8.0,8.8.4); Upgrade oracle agile_plm to a higher version than 9.3.5,9.3.6,and avoid the version 9.3.5,9.3.6; Upgrade oracle application_express to a higher version than 20.2,and avoid the version (,20.2); Upgrade oracle jd_edwards_enterpriseone_tools to a higher version than 9.2.5.2,and avoid the version (,9.2.5.2); Upgrade oracle peoplesoft_enterprise_peopletools to a higher version than -,8.56,8.57,8.58,and avoid the version 8.56,8.57,8.58; Upgrade oracle siebel_apps_-_customer_order_management to a higher version than 21.0,and avoid the version (,21.0); Upgrade oracle webcenter_portal to a higher version than 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0,and avoid the version 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0; Upgrade oracle banking_enterprise_default_management to a higher version than 2.6.2,2.7.0,2.7.1,2.10.0,2.12.0,and avoid the version 2.6.2,2.7.0,2.7.1,2.10.0,2.12.0; Upgrade oracle banking_enterprise_default_managment to a higher version than 2.4.0,and avoid the version [2.3.0,2.4.0]