Cross-Site Scripting (XSS)

🗓️ 20 Jun 2024 06:28:16Reported by Veracode Vulnerability DatabaseType

TinyMCE vulnerability noneditable regex

Reporter	Title	Published	Views	Family All 35
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses tinymce-6.8.3.tgz which is vulnerable to CVE-2024-38357, CVE-2024-38356	19 Sep 202415:46	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of TinyMCE 6.8.2 IBM My webMethods Server is vulnerable to cross-site scripting.	25 Apr 202511:29	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in tinymce-6.8.1.min.js used by IBM Maximo Asset Management application (CVE-2024-38357, CVE-2024-38356)	6 Sep 202408:31	–	ibm
CNNVD	Tiny Technologies TinyMCE Security Vulnerability	19 Jun 202400:00	–	cnnvd
CVE	CVE-2024-38356	19 Jun 202420:03	–	cve
Cvelist	CVE-2024-38356 TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option	19 Jun 202420:03	–	cvelist
Debian CVE	CVE-2024-38356	19 Jun 202420:03	–	debiancve
EUVD	EUVD-2024-2005	3 Oct 202520:07	–	euvd
Github Security Blog	TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option	19 Jun 202415:07	–	github
NCSC	Vulnerabilities fixed in Zimbra	10 Oct 202412:50	–	ncsc

Vulners

Node

tinymce tinymceRange4.7.0–6.8.3js

tinymce tinymceRange7.0.0–7.1.2js

tinymce tinymceRange4.7.0–6.8.3js

tinymce tinymceRange7.0.0–7.1.0js

tinymce tinymceRange4.7.6–6.8.3js

tinymce tinymceRange4.7.0–6.8.2js

Source	Link
github	www.github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d
github	www.github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph
owasp	www.owasp.org/www-community/attacks/xss
tiny	www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/
tiny	www.tiny.cloud/docs/tinymce/7/7.2-release-notes/

20 Jun 2024 15:32Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.1

EPSS0.00744

SSVC