PT-2024-40085 · Tinymce · Tinymce

Published 2024-07-17 · Updated 2024-07-17

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: TinyMCE version 6

Description: The issue arises from a configuration value convert unsafe embeds set to false, allowing svg files with javascript to be used in <object> or <embed> tags, potentially leading to XSS attacks. Note that <embed> tags are not allowed by default. The vulnerability's impact is considered medium, given how TinyMCE is used within certain contexts.

Recommendations: For TinyMCE version 6, update the configuration value convert unsafe embeds to true to mitigate the risk. Alternatively, consider overriding this configuration if necessary, but be aware that this may introduce security risks. As a temporary workaround, consider restricting the use of <object> tags until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-1395

Related Identifiers

GHSA-52CW-PVQ9-9M5V

Affected Products

Tinymce

References · 6

• https://osv.dev/vulnerability/GHSA-52cw-pvq9-9m5v · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2024-001.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-52cw-pvq9-9m5v · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://github.com/advisories/GHSA-5359-pvf2-pw78 · Note
• https://silverstripe.org/download/security-releases/ss-2024-001 · Note