Description

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.

Remediation

References

https://labs.bishopfox.com/advisories/tinymce-version-5.2.1

Related Vulnerabilities

CVE-2017-5617 Vulnerability in maven package com.metsci.ext.com.kitfox.svg:svg-salamander

CVE-2019-10305 Vulnerability in maven package com.xebialabs.xl-deploy:jenkins-dependendencies

CVE-2023-22467 Vulnerability in npm package luxon

CVE-2023-26115 Vulnerability in npm package word-wrap

CVE-2023-45282 Vulnerability in npm package openmct

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory