Medium · published January 27, 2021
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
| Product | Versions | Fixed in |
|---|---|---|
| ckeditor/ckeditor | ≥ 4.0, < 4.16 | 4.16 |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/application_express | < 21.1.0 | 21.1.0 |
| oracle/banking_party_management | all versions | — |
| oracle/commerce_merchandising | ≥ 11.3.0, ≤ 11.3.2 | — |
| oracle/commerce_merchandising | all versions | — |
| oracle/commerce_merchandising | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.6, ≤ 8.0.9 | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_model_management_and_governance | ≥ 8.0.8.0.0, ≤ 8.1.0.0.0 | — |
| oracle/jd_edwards_enterpriseone_tools | < 9.2.6.0 | 9.2.6.0 |
| oracle/siebel_ui_framework | ≤ 21.9 | — |
| oracle/webcenter_sites | all versions | — |
| oracle/webcenter_sites | all versions | — |