CVE-2020-27193

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

Published: Nov 12, 2020
Updated: May 9, 2024
CVE: CVE-2020-27193
GHSA: GHSA-4m44-5j2g-xf64
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
ckeditor / ckeditor	4.15.0	4.15.0.x
oracle / banking_platform	2.4.0	2.4.0.x
oracle / peoplesoft_enterprise_peopletools	8.56	8.56.x
oracle / peoplesoft_enterprise_peopletools	8.57	8.57.x
oracle / agile_plm	9.3.5	9.3.5.x
oracle / agile_plm	9.3.6	9.3.6.x
oracle / peoplesoft_enterprise_peopletools	8.58	8.58.x
oracle / banking_platform	2.7.0	2.7.0.x
oracle / banking_platform	2.7.1	2.7.1.x
oracle / banking_platform	2.9.0	2.9.0.x
oracle / banking_platform	2.8.0	2.8.0.x
oracle / commerce_merchandising	11.0.0	11.0.0.x
oracle / commerce_merchandising	11.1.0	11.1.0.x
oracle / commerce_merchandising	11.2.0	11.2.0.x
oracle / commerce_merchandising	11.3.0	11.3.0.x
oracle / commerce_merchandising	11.3.1	11.3.1.x
oracle / commerce_merchandising	11.3.2	11.3.2.x
oracle / jd_edwards_enterpriseone_tools	-	9.2.6.0
oracle / financial_services_analytical_applications_infrastructure	8.1.1	8.1.1.x
oracle / financial_services_analytical_applications_infrastructure	8.1.0	8.1.0.x
oracle / financial_services_analytical_applications_infrastructure	8.0.6	8.0.9.x
oracle / banking_party_management	2.7.0	2.7.0.x
oracle / application_express	-	21.1.0.00.01
ckeditor4	-	4.15.1

Vulnerability Database

289,599

CVE-2020-27193