CVE-2021-21254 - OpenCVE

CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:S/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ckeditor	Ckeditor5

Configuration 1 [-]

cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr
https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-01-29T21:55:14

Updated: 2024-08-03T18:09:14.916Z

Reserved: 2020-12-22T00:00:00

Link: CVE-2021-21254

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-01-29T22:15:14.797

Modified: 2023-11-07T03:29:41.453

Link: CVE-2021-21254

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "ckeditor5", "vendor": "ckeditor", "versions": [{"status": "affected", "version": "< 25.0.0"}]}], "descriptions": [{"lang": "en", "value": "CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-29T21:55:13", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0"}, {"tags": ["x_refsource_MISC"], "url": "https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm"}], "source": {"advisory": "GHSA-hgmg-hhc8-g5wr", "discovery": "UNKNOWN"}, "title": "Regular expression Denial of Service in Markdown plugin", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-21254", "STATE": "PUBLIC", "TITLE": "Regular expression Denial of Service in Markdown plugin"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ckeditor5", "version": {"version_data": [{"version_value": "< 25.0.0"}]}}]}, "vendor_name": "ckeditor"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400 Uncontrolled Resource Consumption"}]}]}, "references": {"reference_data": [{"name": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr", "refsource": "CONFIRM", "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr"}, {"name": "https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0", "refsource": "MISC", "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0"}, {"name": "https://www.npmjs.com/package/@ckeditor/ckeditor5-markdown-gfm", "refsource": "MISC", "url": "https://www.npmjs.com/package/@ckeditor/ckeditor5-markdown-gfm"}]}, "source": {"advisory": "GHSA-hgmg-hhc8-g5wr", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:09:14.916Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21254", "datePublished": "2021-01-29T21:55:14", "dateReserved": "2020-12-22T00:00:00", "dateUpdated": "2024-08-03T18:09:14.916Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B47943C-76FE-4852-86F0-14CA6F0BD30D", "versionEndExcluding": "25.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0."}, {"lang": "es", "value": "CKEditor 5 es un framework de edici\u00f3n de texto enriquecido de c\u00f3digo abierto con una arquitectura modular. El plugin CKEditor 5 Markdown (@ckeditor/ckeditor5-markdown-gfm) anterior a versi\u00f3n 25.0.0, presenta una vulnerabilidad de denegaci\u00f3n de servicio de expresiones regulares (ReDoS). La vulnerabilidad permiti\u00f3 abusar de la expresi\u00f3n regular de reconocimiento de enlace, lo que podr\u00eda causar una ca\u00edda significativa en el rendimiento resultando en la congelaci\u00f3n de la pesta\u00f1a del navegador. Afecta a todos los usuarios que usan el plugin CKEditor 5 Markdown en la versi\u00f3n anterior a 24.0.0 e incluy\u00e9ndola. El problema ha sido reconocido y parcheado. La correcci\u00f3n estar\u00e1 disponible en la versi\u00f3n 25.0.0"}], "id": "CVE-2021-21254", "lastModified": "2023-11-07T03:29:41.453", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-01-29T22:15:14.797", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr"}, {"source": "security-advisories@github.com", "url": "https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Primary"}]}