Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-VJWG-28GV-PM8H
HistoryApr 24, 2024 - 5:02 p.m.

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

2024-04-2417:02:33
CWE-79
CWE-1395
GitHub Advisory Database
github.com
13
pimcore
tinymce
update
xss
vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

0

Percentile

15.5%

JSON

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1:
https://nvd.nist.gov/vuln/detail/CVE-2024-29203
https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3 or 11.1.6.5.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203
https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Affected configurations

Vulners
Node
pimcorepimcoreRange11.0.0-ALPHA1–11.1.6.5
OR
pimcorepimcoreRange11.2.0–11.2.3
VendorProductVersionCPE
pimcorepimcore*cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*

Related

osv 5
ibm 3
veracode 2
cve 2
nvd 2
cvelist 2
debiancve 2
vulnrichment 2
github 2
oracle 1
osv
osv
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
2024-04-24 17:02:33
CVE-2024-29881
2024-03-26 14:15:09
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 21:23:45
ibm
ibm
Security Bulletin: IBM Maximo Application Suite uses tinymce-5.10.9.tgz which is vulnerable to CVE-2024-29203, CVE-2024-29881, and CVE-2024-29203.
2024-07-15 07:26:37
Security Bulletin: Maximo Asset Management - There is a vulnerability in tinymce-6.7.3.min.js used by IBM Maximo Asset Management application (CVE-2024-29881)
2024-06-12 15:54:53
Security Bulletin: IBM Maximo Asset Management - There is a vulnerability in tinymce-6.7.3.min.js used by IBM Maximo Asset Management application (CVE-2024-29203)
2024-06-12 15:55:11
veracode
veracode
Cross-Site Scripting (XSS)
2024-04-01 05:43:53
Cross-Site Scripting (XSS)
2024-04-01 05:40:45
cve
cve
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
nvd
nvd
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
cvelist
cvelist
CVE-2024-29881 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 13:31:15
CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 13:23:53
debiancve
debiancve
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
vulnrichment
vulnrichment
CVE-2024-29881 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 13:31:15
CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 13:23:53
github
github
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 21:23:45
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 21:23:47
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

0

Percentile

15.5%

JSON
Related for GHSA-VJWG-28GV-PM8H
osv5ibm3veracode2cve2nvd2cvelist2debiancve2vulnrichment2github2oracle1