Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-VJWG-28GV-PM8H
HistoryApr 24, 2024 - 5:02 p.m.

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

2024-04-2417:02:33
Google
osv.dev
18
pimcore
tinymce
bundle
cve-2024-29203
cve-2024-29881
upgrade
xss
vulnerability
security
software

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1:
https://nvd.nist.gov/vuln/detail/CVE-2024-29203
https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3 or 11.1.6.5.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203
https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Related

github 3
osv 4
debiancve 2
cve 2
veracode 2
cvelist 2
nvd 2
ibm 2
github
github
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
2024-04-24 17:02:33
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 21:23:45
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 21:23:47
osv
osv
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 21:23:45
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
debiancve
debiancve
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
cve
cve
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
veracode
veracode
Cross-Site Scripting (XSS)
2024-04-01 05:43:53
Cross-Site Scripting (XSS)
2024-04-01 05:40:45
cvelist
cvelist
CVE-2024-29881 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 13:31:15
CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 13:23:53
nvd
nvd
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
ibm
ibm
Security Bulletin: Maximo Asset Management - There is a vulnerability in tinymce-6.7.3.min.js used by IBM Maximo Asset Management application (CVE-2024-29881)
2024-06-12 15:54:53
Security Bulletin: IBM Maximo Asset Management - There is a vulnerability in tinymce-6.7.3.min.js used by IBM Maximo Asset Management application (CVE-2024-29203)
2024-06-12 15:55:11

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON
Related for OSV:GHSA-VJWG-28GV-PM8H
github3osv4debiancve2cve2veracode2cvelist2nvd2ibm2