Veracode Vulnerability DatabaseVERACODE:46109Cross-Site Scripting (XSS)
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
6.4 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%
TinyMCE is vulnerable to Cross-Site Scripting (XSS). The vulnerability is due to improper iframe restrictions, which allows an attacker add an iframe element with malicious code which will execute upon insertion. Note that malicious code will be sandboxed due to same-origin browser protections.
References
github.com/advisories/GHSA-438c-3975-5x3f
github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1
github.com/tinymce/tinymce/security/advisories/GHSA-438c-3975-5x3f
www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types
www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#sandbox_iframes-editor-option-is-now-defaulted-to-true
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
6.4 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%