PT-2020-15020 · Tinymce · Tinymce

Michał Bentkowski · Published 2020-01-30 · Updated 2021-05-06 · CVE-2020-17480

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.6 and earlier TinyMCE versions 5.1.3 and earlier

Description A cross-site scripting (XSS) issue was discovered in the core parser, paste and visualchars plugins, allowing arbitrary JavaScript execution when inserting specially crafted content into the editor via the clipboard or APIs.

Recommendations For TinyMCE versions 4.9.6 and earlier, upgrade to TinyMCE 4.9.7. For TinyMCE versions 5.1.3 and earlier, upgrade to TinyMCE 5.1.4. As a temporary workaround, consider disabling the impacted plugins. Manually sanitize the content using the BeforeSetContent event.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-17480

GHSA-27GM-GHR9-4V95

GHSA-P7J5-4MWM-HV86

Affected Products

Tinymce

References · 11

• 🔥 https://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95 · Exploit
• https://osv.dev/vulnerability/GHSA-27gm-ghr9-4v95 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-17480 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-17480 · Security Note
• https://tiny.cloud/docs/release-notes/release-notes514/#securityfixes · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-17480 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p7j5-4mwm-hv86 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17480 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17480 · Vendor Advisory
• https://github.com/tinymce/tinymce · Note
• https://portswigger.net/daily-swig/xss-vulnerability-patched-in-tinymce · Note