CVE-2020-17480 (Medium) detected in tinymce-4.2.4.min.js

[mend-bolt-for-github[bot]]

CVE-2020-17480 - Medium Severity Vulnerability

Vulnerable Library - tinymce-4.2.4.min.js

TinyMCE rich text editor

Library home page: https://cdnjs.cloudflare.com/ajax/libs/tinymce/4.2.4/tinymce.min.js

Path to vulnerable library: /admin/editors/tinymce/tinymce.min.js

Dependency Hierarchy: - :x: **tinymce-4.2.4.min.js** (Vulnerable Library)

Found in HEAD commit: df351b2afd89988ab17bca6c76add5ddebcf055b

Found in base branch: main

Vulnerability Details

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.

Publish Date: 2020-08-10

URL: CVE-2020-17480

CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-08-11

Fix Resolution: 4.9.7, 5.1.4

---

Step up your Open Source Security Game with Mend here