Cross-Site Scripting Vulnerability in TinyMCE by Tiny Technologies
CVE-2012-4230

Currently unrated

Key Information:

Vendor

Tinymce

Status
Tinymce
Vendor
CVE Published:
25 April 2014

What is CVE-2012-4230?

The bbcode plugin in TinyMCE version 3.5.8 exhibits a security vulnerability due to inadequate enforcement of the security policy, particularly concerning the encoding directive and the valid_elements attribute. This lack of enforcement opens the door for attackers to exploit the system, enabling them to conduct cross-site scripting (XSS) attacks through various application-specific vectors, such as utilizing textarea elements.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/82744
vdb-entryx_refsource_XF
http://www.madirish.net/554
x_refsource_MISC
http://seclists.org/fulldisclosure/2013/Mar/114
mailing-listx_refsource_FULLDISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.