What’s Vulnerable › Vulnerabilities
CVE-2020-27193
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-11-12 · updated 2026-08-25
- Weakness: CWE-79
Description
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.
Affected products
- ckeditor4: 4.15.0
- Oracle Corporation Oracle Agile PLM: 9.3.5, 9.3.6
- Oracle Corporation Application Express: before 21.1.0.00.01 — fixed in 21.1.0.00.01
- Oracle Banking Party Management: 2.7.0
- Oracle Banking Platform: 2.4.0, 2.7.0, 2.7.1, 2.8.0, 2.9.0
- Oracle Corporation Commerce Merchandising: 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.3.1, 11.3.2
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.0.9; 8.1.0, 8.1.1
- Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.0 — fixed in 9.2.6.0
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.56, 8.57, 8.58
How to fix
Upgrade to a fixed version: Oracle Corporation Application Express 21.1.0.00.01; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.0. Check the vendor advisory for mitigations.
References
- https://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/
- https://ckeditor.com/cke4/release/CKEditor-4.15.1
- https://ckeditor.com/ckeditor-4/download/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-released/
- https://ckeditor.com/cke4/release/CKEditor-4.15.1
- https://ckeditor.com/ckeditor-4/download/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Get alerted when CVE-2020-27193 or the next vulnerability affects your stack