CVE catalog

CVE-2021-37695

ckeditor: CVE-2021-37695

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 25, 2026

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianckeditorbookworm4.19.1+dfsg-1fixed
Debianckeditor3bookworm3.6.6.1+dfsg-7not affected
Ubuntuckeditorpro4.4.4+dfsg1-3vulnerable
Ubuntuckeditorpro4.5.6+dfsg-1vulnerable
Ubuntuckeditorpro4.5.7+dfsg-1vulnerable
Ubuntuckeditorpro4.5.7+dfsg-2vulnerable
Ubuntuckeditorpro4.5.7+dfsg-2ubuntu0.16.04.1~esm1fixed
Ubuntuldap-account-manager16.044.9-1vulnerable
Ubuntuldap-account-manager16.045.1-1vulnerable
Ubuntuldap-account-manager16.045.2-1vulnerable
Ubuntuldap-account-manager16.045.2-1ubuntu1vulnerable
Ubunturequest-tracker416.044.2.11-2vulnerable
Ubunturequest-tracker416.044.2.12-3vulnerable
Ubunturequest-tracker416.044.2.12-4vulnerable
Ubunturequest-tracker416.044.2.12-5vulnerable
Ubuntuckeditor18.044.5.7+dfsg-2vulnerable
Ubuntuckeditor18.044.5.7+dfsg-2ubuntu0.18.04.1fixed
Ubuntuckeditor318.043.6.6.1+dfsg-1vulnerable
Ubuntuldap-account-manager18.045.7-1vulnerable
Ubuntuldap-account-manager18.046.1-1vulnerable
Ubuntuldap-account-manager18.046.2-1vulnerable
Ubunturequest-tracker4pro4.4.1-5vulnerable
Ubunturequest-tracker4pro4.4.2-1vulnerable
Ubunturequest-tracker4pro4.4.2-2vulnerable
Ubunturequest-tracker4pro4.4.2-2ubuntu0.1~esm1vulnerable
Ubuntuckeditor20.044.11.1+dfsg-1vulnerable
Ubuntuckeditor20.044.12.1+dfsg-1vulnerable
Ubuntuckeditor20.044.12.1+dfsg-1ubuntu0.1fixed
Ubuntuckeditor320.043.6.6.1+dfsg-3vulnerable
Ubuntuckeditor320.043.6.6.1+dfsg-4vulnerable
Ubuntuldap-account-manager20.046.7-1vulnerable
Ubunturequest-tracker420.044.4.3-2vulnerable
Ubunturequest-tracker420.044.4.3-2+deb10u3build0.20.04.1vulnerable
Ubuntuckeditor322.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager22.047.5-1vulnerable
Ubuntuldap-account-manager22.047.7-1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1.22.04.1vulnerable
Ubuntuckeditor324.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager24.048.3-1vulnerable
Ubuntuldap-account-manager24.048.5-1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu2vulnerable
Ubunturequest-tracker424.044.4.7+dfsg-1vulnerable
Ubuntuldap-account-manager25.109.0-1vulnerable
Ubunturequest-tracker425.104.4.7+dfsg-4syncable1vulnerable
Ubuntuldap-account-manager26.049.0-1vulnerable
Ubuntuldap-account-manager26.049.0-1build1vulnerable
Ubunturequest-tracker426.044.4.7+dfsg-4syncable1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianckeditorsourcebookworm4.16.2+dfsg-1not yet assignedNot reported[992290]
Debianckeditor3sourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntuckeditordebpro4.5.7+dfsg-2ubuntu0.16.04.1~esm1Not reportedUBUNTU-CVE-2021-37695Not reported
Ubuntuckeditordeb18.044.5.7+dfsg-2ubuntu0.18.04.1Not reportedUBUNTU-CVE-2021-37695Not reported
Ubuntuckeditordeb20.044.12.1+dfsg-1ubuntu0.1Not reportedUBUNTU-CVE-2021-37695Not reported

[Debian bug #992290]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ckeditor]Fixed
    Details (2)

    • 4.19.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 4.16.2+dfsg-1

      dsa · ckeditor · debian · bookworm; dsa · ckeditor · debian · 12

    • 4.19.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 4.16.2+dfsg-1

      dsa · ckeditor · debian · bookworm; dsa · ckeditor · debian · 12

  • [ckeditor3]Not affected
    Details (2)

    • 3.6.6.1+dfsg-7 · all · bookworm

      Not affected

      dsa · ckeditor3 · debian · bookworm

    • 3.6.6.1+dfsg-7 · all · bookworm

      Not affected

      dsa · ckeditor3 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]