Lucene search

GitHub Advisory DatabaseGHSA-W9JX-4G6G-RP7X

HistoryJun 19, 2024 - 3:07 p.m.

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

2024-06-1915:07:03

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

tinymce

vulnerability

noscript elements

patches

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.8

Confidence

High

EPSS

Percentile

15.5%

JSON

Impact

A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor.

Patches

This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed.

Fix

To avoid this vulnerability:

Upgrade to TinyMCE 7.2.0 or higher.
Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x.
Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract).

Acknowledgements

Tiny thanks Malav Khatri and another reporter for their help identifying this vulnerability.

References

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]
Open an issue in the TinyMCE repo

Affected configurations

Vulners

Node

tinymcedjango-tinymceRange≤4.0.0

tinymcetinymceRange7.0.0–7.2.0

tinymcetinymceRange6.0.0–6.8.4

tinymcetinymceRange7.0.0–7.2.0

tinymcetinymceRange6.0.0–6.8.4

tinymcetinymceRange7.0.0–7.2.0

tinymcetinymceRange6.0.0–6.8.4

tinymcetinymceRange<5.11.0

VendorProductVersionCPE
tinymcedjango-tinymce*cpe:2.3:a:tinymce:django-tinymce:*:*:*:*:*:*:*:*
tinymcetinymce*cpe:2.3:a:tinymce:tinymce:*:*:*:*:*:*:*:*