What’s Vulnerable › Vulnerabilities
CVE-2020-9281
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-03-07 · updated 2026-08-25
- Weakness: CWE-79
Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Affected products
- ckeditor4: from 4.0 before 4.14 — fixed in 4.14
- Drupal: from 8.7.0 before 8.7.12; from 8.8.0 before 8.8.4 — fixed in 8.7.12, 8.8.4
- Fedoraproject Fedora: 30, 31, 32
- Oracle Corporation Oracle Agile PLM: 9.3.5, 9.3.6
- Oracle Corporation Application Express: before 20.2 — fixed in 20.2
- Oracle Banking Enterprise Default Management: 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
- Oracle Banking Enterprise Default Managment: from 2.3.0 through 2.4.0
- Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.5.2 — fixed in 9.2.5.2
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.56, 8.57, 8.58
- Oracle Corporation Siebel Apps - Customer Order Management: before 21.0 — fixed in 21.0
- Oracle Corporation Oracle WebCenter Portal: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
How to fix
Upgrade to a fixed version: ckeditor4 4.14; Drupal 8.7.12, 8.8.4; Oracle Corporation Application Express 20.2; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.5.2; Oracle Corporation Siebel Apps - Customer Order Management 21.0. Check the vendor advisory for mitigations.
References
- https://github.com/ckeditor/ckeditor4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/ckeditor/ckeditor4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/
Get alerted when CVE-2020-9281 or the next vulnerability affects your stack