A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.
WS-2020-0142 - Medium Severity Vulnerability
TinyMCE rich text editor
Library home page: https://cdnjs.cloudflare.com/ajax/libs/tinymce/4.2.4/tinymce.min.js
Path to vulnerable library: /admin/editors/tinymce/tinymce.min.js
Dependency Hierarchy: - :x: **tinymce-4.2.4.min.js** (Vulnerable Library)
Found in HEAD commit: df351b2afd89988ab17bca6c76add5ddebcf055b
Found in base branch: main
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.
Publish Date: 2020-08-11
URL: WS-2020-0142
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-vrv8-v4w8-f95h
Release Date: 2020-08-11
Fix Resolution: tinymce - 5.4.1, 4.9.11
Step up your Open Source Security Game with Mend here