Input validation error in CKEditor - CVE-2021-26271
Published: January 27, 2021
Vulnerability identifier: #VU50055
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-26271
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a regular expression denial of service (ReDoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to paste a specially crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin) and perform a regular expression denial of service (ReDoS) attack.
Affected software
CKEditor
IBM Sterling Partner Engagement Manager
IBM Engineering Requirements Management DOORS Next
IBM Sterling Partner Engagement Manager
IBM Engineering Requirements Management DOORS Next
How to mitigate CVE-2021-26271
Install updates from vendor's website.
CKEditor - update to 4.16.0
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8