PT-2023-33068 · Tinymce · Tinymce

Publicado 2023-04-26 · Atualizado 2023-04-26

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.10 and earlier TinyMCE versions 5.4.0 and earlier

Description A cross-site scripting (XSS) issue was found in the core parser of TinyMCE, allowing arbitrary JavaScript execution when inserting specially crafted content into the editor via the clipboard or APIs.

Recommendations For TinyMCE versions 4.9.10 and earlier, update to a version higher than 4.9.10 to resolve the issue. For TinyMCE versions 5.4.0 and earlier, update to a version higher than 5.4.0 to resolve the issue.

Correção

Identificadores relacionados

GHSA-WQM8-JX8R-8RCQ

Produtos afetados

Tinymce

Referências · 7

• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/SS-2023-001.yaml · Nota
• https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-wqm8-jx8r-8rcq · Nota
• https://github.com/silverstripe/silverstripe-admin · Nota
• https://github.com/advisories/GHSA-vrv8-v4w8-f95h · Nota
• https://tiny.cloud/docs/release-notes/release-notes54/#securityfixes · Nota
• https://silverstripe.org/download/security-releases/ss-2023-001 · Nota
• https://osv.dev/vulnerability/GHSA-wqm8-jx8r-8rcq · Aviso do Fabricante