Improper Input Neutralization Vulnerability in tinymce by Tiny Technologies
CVE-2019-1010091

6.1MEDIUM

Key Information:

Vendor

Tinymce

Status
Tinymce
Vendor
CVE Published:
17 July 2019

What is CVE-2019-1010091?

The tinymce versions 4.7.11 and 4.7.12 are susceptible to a vulnerability that allows for improper neutralization of user input, leading to potential JavaScript code execution. Attackers can exploit this flaw by persuading victims to paste malicious content into the media element's embed tab, which could then execute harmful scripts in a web context. This issue exemplifies the critical need for validating input to prevent unauthorized actions and protect users.

Affected Version(s)

tinymce 4.7.11, 4.7.12

References

https://github.com/tinymce/tinymce/issues/4394
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.