Back to Database
Status published
Medium
CVE-2020-9281
A cross-site scripting (XSS) vulnerability in the HTML Data Processor...
Vulnerability Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-9281
Credits & Attribution
No credits recorded in the NVD database.
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/ckeditor/ckeditor4
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
More from ckeditor
View All →CVE-2025-58064
CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package
Low
2.3
CVE-2025-25299
Cross-site scripting (XSS) in the real-time collaboration package
Low
2.3
CVE-2024-45613
CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package
Medium
5.1
CVE-2024-43411
CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover
Low
3.1
CVE-2024-43407
Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability
Medium
6.1
Affected Vendor
ckeditor
View all reports →Affected Software
ckeditor, fedora, drupal, agile plm, application express, jd edwards enterpriseone tools, peoplesoft enterprise peopletools, siebel apps - customer order management, webcenter portal, banking enterprise default management, banking enterprise default managment
Vulnerable Versions:
4.0, 30, 31, 32, 8.7.0, 8.8.0, 9.3.5, 9.3.6, 0, 8.56, 8.57, 8.58, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0, 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0, 2.3.0
Timeline
Official Publish:
March 7th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.