TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes (tinymce tinymce)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.71 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
- https://github.com/tinymce/tinymce/security/advisories/GHSA-438c-3975-5x3f
- https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1
- https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types
- https://www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#sandbox_iframes-editor-option-is-now-defaulted-to-true
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-438c-3975-5x3f — TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
European references
- ENISA EUVD · EUVD-2024-0810
- GCVE · GCVE-0-2024-29203
Affected configurations (NVD CPE)
cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*< 6.8.1cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*≥ 6.8.2 < 7.0.0
Affected products
| Product | Versions |
|---|---|
| tinymce · tinymce | affected < 6.8.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |