PT-2024-7087 · Tinymce+2 · Tinymce+2

Malav-Mk · Published 2024-06-19 · Updated 2026-04-29 · CVE-2024-38357

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.11.0 LTS TinyMCE versions prior to 6.8.4 TinyMCE versions prior to 7.2.0

Description A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor.

Recommendations

• Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x.
• Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x.
• Upgrade to TinyMCE 7.2.0 or higher for TinyMCE 7.x.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-08354

CVE-2024-38357

GHSA-W9JX-4G6G-RP7X

USN-8223-1

Affected Products

Linuxmint

Tinymce

Ubuntu

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38357.json · Exploit
• https://bdu.fstec.ru/vul/2024-08354 · Security Note
• https://ubuntu.com/security/CVE-2024-42008 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38357 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25916 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38357 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8223-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38357 · Security Note
• https://ubuntu.com/security/notices/USN-8223-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15237 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-38357 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38357 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42010 · Vendor Advisory