Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-41165

CVE-2021-41165: HTML comments vulnerability allowing to execute JavaScript code

8.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-41165
GHSA ID
GHSA-7h26-63m7-qhf2
EPSS Score
0.32395%
CWE
CWE-79
Published
11/17/2021
Updated
12/28/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
ckeditor4npm< 4.17.04.17.0
ckeditor/ckeditorcomposer< 4.17.04.17.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The analysis is based on the description of the vulnerability and the nature of the patch. The exact functions were inferred based on the typical areas of code that would be involved in handling HTML comments and the execution of JavaScript code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### *****t** p**k***s T** vuln*r**ility **s ***n *is*ov*r** in t** *or* *TML pro**ssin* mo*ul* *n* m*y *****t *ll plu*ins us** *y *K**itor *. ### Imp**t * pot*nti*l vuln*r**ility **s ***n *is*ov*r** in *K**itor * *TML pro**ssin* *or* mo*ul*. T** vul

Reasoning

T** *n*lysis is **s** on t** **s*ription o* t** vuln*r**ility *n* t** n*tur* o* t** p*t**. T** *x**t *un*tions w*r* in**rr** **s** on t** typi**l *r**s o* *o** t**t woul* ** involv** in **n*lin* `*TML` *omm*nts *n* t** *x**ution o* `J*v*S*ript` *o**.