PT-2023-33068 · Tinymce · Tinymce

Published 2023-04-26 · Updated 2023-04-26

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.10 and earlier TinyMCE versions 5.4.0 and earlier

Description A cross-site scripting (XSS) issue was found in the core parser of TinyMCE, allowing arbitrary JavaScript execution when inserting specially crafted content into the editor via the clipboard or APIs.

Recommendations For TinyMCE versions 4.9.10 and earlier, update to a version higher than 4.9.10 to resolve the issue. For TinyMCE versions 5.4.0 and earlier, update to a version higher than 5.4.0 to resolve the issue.

Fix

Related Identifiers

GHSA-WQM8-JX8R-8RCQ

Affected Products

Tinymce

References · 7

• https://osv.dev/vulnerability/GHSA-wqm8-jx8r-8rcq · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/SS-2023-001.yaml · Note
• https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-wqm8-jx8r-8rcq · Note
• https://github.com/silverstripe/silverstripe-admin · Note
• https://github.com/advisories/GHSA-vrv8-v4w8-f95h · Note
• https://tiny.cloud/docs/release-notes/release-notes54/#securityfixes · Note
• https://silverstripe.org/download/security-releases/ss-2023-001 · Note