PT-2014-2276 · Moxiecode Systems · Tinymce

Justin C. Klein Keane + 1 · Publicado 2014-04-25 · Atualizado 2017-08-29 · CVE-2012-4230

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE version 3.5.8

Description The issue concerns the bbcode plugin in TinyMCE, which fails to properly enforce the security policy. This specifically affects the encoding directive and the valid elements attribute, allowing for cross-site scripting (XSS) attacks. An example of exploitation involves using a textarea element.

Recommendations For TinyMCE version 3.5.8, consider disabling the bbcode plugin until a patch is available to prevent potential XSS attacks. Restrict access to the valid elements attribute and encoding directive to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4230

Produtos afetados

Tinymce

Referências · 12

• 🔥 http://madirish.net/554 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2013/Mar/114 · Exploit
• 🔥 http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4230 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82744 · Nota
• http://xforce.iss.net/xforce/xfdb/82744 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4230 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4230 · Aviso do Fabricante
• http://securityfocus.com/bid/58424 · Nota
• https://cve.org/CVERecord?id=CVE-2012-4230 · Nota de Segurança
• http://osvdb.org/91130 · Nota
• https://ubuntu.com/security/CVE-2012-4230 · Aviso do Fabricante