PT-2024-5043 · Tinymce+2 · Tinymce+2

Ekimchau · Published 2024-06-19 · Updated 2026-04-29 · CVE-2024-38356

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.11.0 LTS TinyMCE versions prior to 6.8.4 TinyMCE versions prior to 7.2.0

Description: A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditable regexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor.

Recommendations:

• Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x.
• Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x.
• Upgrade to TinyMCE 7.2.0 or higher for TinyMCE 7.x.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-05570

CVE-2024-38356

GHSA-9HCV-J9PV-QMPH

USN-8223-1

Affected Products

Linuxmint

Tinymce

Ubuntu

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38356.json · Exploit
• https://cve.org/CVERecord?id=CVE-2024-38356 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42008 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38357 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25916 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38356 · Security Note
• https://osv.dev/vulnerability/USN-8223-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26079 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38356 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8223-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05570 · Security Note