TinyMCE Fixes Cross-Site Scripting Vulnerability
CVE-2024-29881

4.3MEDIUM

Key Information:

Vendor

Tinymce

Status
Tinymce
Vendor
CVE Published:
26 March 2024

What is CVE-2024-29881?

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.

Affected Version(s)

tinymce < 7.0.0

References

https://github.com/tinymce/tinymce/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2c...
x_refsource_MISC
https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.