{"id":"CVE-2020-9281","title":"A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted \"protected\" comment (with the cke_protected syntax).","summary":"A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted \"protected\" comment (with the cke_protected syntax).","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"ckeditor","product":"ckeditor","affected":["ckeditor >= 4.0, < 4.14","fedora = 30","fedora = 31","fedora = 32","drupal >= 8.7.0, < 8.7.12","drupal >= 8.8.0, < 8.8.4","agile_product_lifecycle_management = 9.3.5","agile_product_lifecycle_management = 9.3.6","application_express < 20.2","jd_edwards_enterpriseone_tools < 9.2.5.2","peoplesoft_enterprise_peopletools","peoplesoft_enterprise_peopletools = 8.56","peoplesoft_enterprise_peopletools = 8.57","peoplesoft_enterprise_peopletools = 8.58","siebel_apps_-_customer_order_management < 21.0","webcenter_portal = 11.1.1.9.0","webcenter_portal = 12.2.1.3.0","webcenter_portal = 12.2.1.4.0","banking_enterprise_default_management = 2.6.2","banking_enterprise_default_management = 2.7.0","banking_enterprise_default_management = 2.7.1","banking_enterprise_default_management = 2.10.0","banking_enterprise_default_management = 2.12.0","banking_enterprise_default_managment >= 2.3.0, <= 2.4.0"],"patched":["ckeditor 4.14","drupal 8.8.4","application_express 20.2","jd_edwards_enterpriseone_tools 9.2.5.2","siebel_apps_-_customer_order_management 21.0"],"published":"2020-03-07","updated":"2026-08-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-9281","references":[{"url":"https://github.com/ckeditor/ckeditor4","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"cve@mitre.org"},{"url":"https://github.com/ckeditor/ckeditor4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.04308,"epssPercentile":0.90738,"ingestedAt":"2026-08-25T17:29:29.444Z","slug":"CVE-2020-9281","body":"## Overview\n\nA cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted \"protected\" comment (with the cke_protected syntax).\n\n## Affected\n\n- `ckeditor >= 4.0, < 4.14`\n- `fedora = 30`\n- `fedora = 31`\n- `fedora = 32`\n- `drupal >= 8.7.0, < 8.7.12`\n- `drupal >= 8.8.0, < 8.8.4`\n- `agile_product_lifecycle_management = 9.3.5`\n- `agile_product_lifecycle_management = 9.3.6`\n- `application_express < 20.2`\n- `jd_edwards_enterpriseone_tools < 9.2.5.2`\n- `peoplesoft_enterprise_peopletools`\n- `peoplesoft_enterprise_peopletools = 8.56`\n- `peoplesoft_enterprise_peopletools = 8.57`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `siebel_apps_-_customer_order_management < 21.0`\n- `webcenter_portal = 11.1.1.9.0`\n- `webcenter_portal = 12.2.1.3.0`\n- `webcenter_portal = 12.2.1.4.0`\n- `banking_enterprise_default_management = 2.6.2`\n- `banking_enterprise_default_management = 2.7.0`\n- `banking_enterprise_default_management = 2.7.1`\n- `banking_enterprise_default_management = 2.10.0`\n- `banking_enterprise_default_management = 2.12.0`\n- `banking_enterprise_default_managment >= 2.3.0, <= 2.4.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ckeditor 4.14`\n- `drupal 8.8.4`\n- `application_express 20.2`\n- `jd_edwards_enterpriseone_tools 9.2.5.2`\n- `siebel_apps_-_customer_order_management 21.0`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[]}