6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditable_regexp
option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor.
This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the noneditable_regexp
option, any content within an attribute is properly verified to match the configured regular expression before being added.
To avoid this vulnerability:
If you have any questions or comments about this advisory:
github.com/tinymce/tinymce
github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d
github.com/tinymce/tinymce/commit/a9fb858509f86dacfa8b01cfd34653b408983ac0
github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph
nvd.nist.gov/vuln/detail/CVE-2024-38356
owasp.org/www-community/attacks/xss
www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview
www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview
www.tiny.cloud/docs/tinymce/latest/7.2-release-notes/#overview
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%