PT-2014-2276 · Moxiecode Systems · Tinymce

Justin C. Klein Keane + 1 · Published 2014-04-25 · Updated 2017-08-29 · CVE-2012-4230

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE version 3.5.8

Description The issue concerns the bbcode plugin in TinyMCE, which fails to properly enforce the security policy. This specifically affects the encoding directive and the valid elements attribute, allowing for cross-site scripting (XSS) attacks. An example of exploitation involves using a textarea element.

Recommendations For TinyMCE version 3.5.8, consider disabling the bbcode plugin until a patch is available to prevent potential XSS attacks. Restrict access to the valid elements attribute and encoding directive to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4230

Affected Products

Tinymce

References · 12

• 🔥 http://madirish.net/554 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2013/Mar/114 · Exploit
• 🔥 http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4230 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4230 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-4230 · Security Note
• https://ubuntu.com/security/CVE-2012-4230 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82744 · Note
• http://xforce.iss.net/xforce/xfdb/82744 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4230 · Note
• http://securityfocus.com/bid/58424 · Note
• http://osvdb.org/91130 · Note