Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:44298
HistoryNov 16, 2023 - 9:53 a.m.

Mutation Cross-Site Scripting (mXSS)

2023-11-1609:53:14
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
tinymce
vulnerability
mutation
cross-site scripting
sanitization
text nodes
attacker
malicious scripts
software

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

20.6%

JSON

tinymce is vulnerable to mutation cross-site scripting (mXSS). The vulnerability is caused due to lack of sanitization in handling of text nodes.This could allow an attacker to inject malicious scripts.

Related

prion 1
osv 2
ibm 2
cve 1
debiancve 1
nvd 1
freebsd 1
ubuntucve 1
cvelist 1
nessus 1
github 1
vulnrichment 1
prion
prion
Cross site scripting
2023-11-15 19:15:00
osv
osv
CVE-2023-48219
2023-11-15 19:15:07
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
2023-11-15 18:32:34
ibm
ibm
Security Bulletin: IBM Maximo Application Suite uses tinymce-5.10.8.tgz which is vulnerable to CVE-2023-48219
2024-02-06 09:44:30
Security Bulletin: There is a vulnerability in tinymce-6.7.1.min.js used by IBM Maximo Asset Management application (CVE-2023-48219)
2024-03-12 20:56:49
cve
cve
CVE-2023-48219
2023-11-15 19:15:07
debiancve
debiancve
CVE-2023-48219
2023-11-15 19:15:07
nvd
nvd
CVE-2023-48219
2023-11-15 19:15:07
freebsd
freebsd
TinyMCE -- mXSS in multiple plugins
2023-11-15 00:00:00
ubuntucve
ubuntucve
CVE-2023-48219
2023-11-15 00:00:00
cvelist
cvelist
CVE-2023-48219 Special characters in unescaped text nodes can trigger mXSS in TinyMCE
2023-11-15 18:59:03
nessus
nessus
FreeBSD : TinyMCE -- mXSS in multiple plugins (9532a361-b84d-11ee-b0d7-84a93843eb75)
2024-01-24 00:00:00
github
github
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
2023-11-15 18:32:34
vulnrichment
vulnrichment
CVE-2023-48219 Special characters in unescaped text nodes can trigger mXSS in TinyMCE
2023-11-15 18:59:03

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

20.6%

JSON
Related for VERACODE:44298
prion1osv2ibm2cve1debiancve1nvd1freebsd1ubuntucve1cvelist1nessus1github1vulnrichment1