PT-2024-22805 · Tinymce · Tinymce

Ekimchau · Published 2024-03-26 · Updated 2026-03-19 · CVE-2024-29203

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 6.8.1

Description A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets.

Recommendations For versions prior to 6.8.1, update to version 6.8.1 or later to fix the vulnerability. As a temporary workaround, consider configuring the HTTP Content-Security-Policy (CSP) frame-src or object-src to restrict or block the loading of unauthorized URLs. In TinyMCE 7.0.0 and later, the sandbox iframes option is enabled by default, which adds the sandbox="" attribute to every iframe element. To sandbox iframe elements from every domain, set the sandbox iframes exclusions option to [].

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-29203

GHSA-438C-3975-5X3F

Affected Products

Tinymce

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29203.json · Exploit
• https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1 · Patch
• https://github.com/tinymce/tinymce/security/advisories/GHSA-438c-3975-5x3f · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-29203 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-29203 · Security Note
• https://osv.dev/vulnerability/GHSA-438c-3975-5x3f · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29203 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-29203 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29203 · Vendor Advisory
• https://github.com/tinymce/tinymce · Note
• https://twitter.com/CVEnew/status/1772618961575633064 · Twitter Post
• https://t.me/cveNotify/134077 · Telegram Post
• https://twitter.com/RedPacketSec/status/1773291619824832984 · Twitter Post
• https://tiny.cloud/docs/tinymce/7/7.0-release-notes/#sandbox_iframes-editor-option-is-now-defaulted-to-true · Note
• https://twitter.com/VulmonFeeds/status/1772664394775732476 · Twitter Post