Cross-Site Scripting (XSS)

🗓️ 01 Apr 2024 05:40:45Reported by Veracode Vulnerability DatabaseType

TinyMCE XSS vulnerability due to improper iframe restrictions

Reporter	Title	Published	Views	Family All 22
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses tinymce-5.10.9.tgz which is vulnerable to CVE-2024-29203, CVE-2024-29881, and CVE-2024-29203.	15 Jul 202407:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Asset Management - There is a vulnerability in tinymce-6.7.3.min.js used by IBM Maximo Asset Management application (CVE-2024-29203)	12 Jun 202415:55	–	ibm
CNNVD	Tiny Technologies TinyMCE 安全漏洞	26 Mar 202400:00	–	cnnvd
CVE	CVE-2024-29203	26 Mar 202413:23	–	cve
Cvelist	CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes	26 Mar 202413:23	–	cvelist
Debian CVE	CVE-2024-29203	26 Mar 202413:23	–	debiancve
EUVD	EUVD-2024-0810	3 Oct 202520:07	–	euvd
Github Security Blog	TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes	26 Mar 202421:23	–	github
Github Security Blog	Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881	24 Apr 202417:02	–	github
Atlassian	Upgrade tinyMCE to >= 7.0.0 to mitigate CVE-2024-29881/29203	8 Oct 202421:27	–	atlassian

Vulners

Node

tinymce tinymceRange4.0.25–6.8.3js

tinymce tinymceRange3.4.3.2–6.8.3js

tinymce tinymceRange4.1.9–5.0.9js

tinymce tinymceRange4.7.6–6.8.3js

tinymce tinymceRange4.0.0–6.8.2js

Source	Link
github	www.github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1
github	www.github.com/advisories/GHSA-438c-3975-5x3f
github	www.github.com/tinymce/tinymce/security/advisories/GHSA-438c-3975-5x3f
tiny	www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/
tiny	www.tiny.cloud/docs/tinymce/7/7.0-release-notes/

02 Apr 2024 18:58Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.14.3

EPSS0.01605

SSVC